From bcbb9370ddaa223110fcd8584e41336b791e7e7f Mon Sep 17 00:00:00 2001 From: Rich Trott Date: Wed, 10 Oct 2018 06:33:13 -0700 Subject: doc: revise security-reporting text in README Simplify and clarify the security-reporting text in the README. Now is also probably a good time to ping the security triage folks to make sure the text is still accurate. PR-URL: https://github.com/nodejs/node/pull/23407 Reviewed-By: Sakthipriyan Vairamani Reviewed-By: Yuta Hiroto Reviewed-By: Myles Borins Reviewed-By: Anna Henningsen Reviewed-By: Matteo Collina Reviewed-By: James M Snell --- README.md | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index 47e178845d..ae2f28b2da 100644 --- a/README.md +++ b/README.md @@ -159,13 +159,12 @@ source and a list of supported platforms. ## Security -Security flaws in Node.js should be reported by emailing security@nodejs.org. -Please do not disclose security bugs publicly until they have been handled by -the security team. +If you find a security vulnerability in Node.js, please report it to +security@nodejs.org. Please withhold public disclosure until after the security +team has addressed the vulnerability. -Your email will be acknowledged within 24 hours, and you will receive a more -detailed response to your email within 48 hours indicating the next steps in -handling your report. +The security team will acknowledge your email within 24 hours. You will receive +a more detailed response within 48 hours. There are no hard and fast rules to determine if a bug is worth reporting as a security issue. The general rule is an issue worth reporting should allow an -- cgit v1.2.3