Add security policy to GraphQL-TSC.md #881
Conversation
GraphQL-TSC.md
Outdated
| @@ -286,6 +286,16 @@ If consensus cannot be reached, a pull request may still be landed after a vote | |||
|
|
|||
| An exception is made for errata or to update meeting logistics. These may be landed immediately, provided all EasyCLA checks have passed. | |||
|
|
|||
| ### Security policy | |||
|
|
|||
| The GraphQL TSC is in an elevated position of trust within the GraphQL community. Security concerns that impact repos under the [`graphql` GitHub org](https://github.com/graphql/) (including reference implementations and official tools) may be responsibly disclosed to the TSC via [any current TSC member](https://github.com/graphql/graphql-wg/blob/main/GraphQL-TSC.md#tsc-members-1), with the expectation that they will be discussed and triaged by the TSC as a whole. | |||
There was a problem hiding this comment.
@brianwarner should we set up an email alias to have a more clear disclosure guidance?
There was a problem hiding this comment.
Sure thing. "[email protected]"? Maybe going to you and the operations@ alias?
In my experience these tend to attract a lot of spam and emails from bug bounty farms, so it probably makes sense going to someone who can triage before passing it along.
There was a problem hiding this comment.
This email is up and running if you want to swap this language @benjie
|
Hi folks! Have you considered adding a The same goes for the main website. Seems worth linking from contacts page to the policy. |
|
I have one open for spec here: graphql/graphql-spec#930 but it might make sense to create it in the https://github.com/graphql/.github repo instead so it automatically applies to all repos (but can still be overridden if desired). What do you think @graphql/tsc? |
As discussed in https://github.com/graphql/tsc/discussions/5 and #825, this text was proposed by @brianwarner and has been lightly edited by myself.
According to making changes to this document:
TL;DR: this PR can be merged after 2022-02-06T14:40:00Z assuming it gets two approvals and no objections