Missing security policy and private vuln reporting in this repo

[maresb]

Checklist

• I added a descriptive title
• I searched open reports and couldn't find a duplicate

What happened?

I would like to discuss something security-related, but the security policy that enables GitHub's private vulnerability reporting is not enabled for this repo. Could you please enable it?

For more info, please see https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository

Based on my current understanding, I wouldn't classify the urgency as severe. However, I would feel a lot better if I had a second opinion.

Additional Context

No response

[danyeaw]

Hi @maresb, thanks for suggesting this. We do have conda private vulnerability reporting enabled here: https://github.com/conda/conda/security/advisories. Do you think that your report is specific enough to this repo that enabling it here is also needed?

[maresb]

Thanks @danyeaw for getting back to me on this! The report I'd like to make is specific to this repo, but I'm happy to report in conda/conda instead.

It would be nice if there were a SECURITY.md here (and everywhere) indicating the proper procedure.

One option is to create a GitHub-org-level SECURITY.md file in https://github.com/conda/.github. This would add a "Report security vulnerability" option to the "New issue" flow for all repos:

https://github.com/conda/.github

The "Report security vulnerability" option redirects to the SECURITY.md so you could just link to https://github.com/conda/conda/security/advisories from there.

[maresb]

I opened a PR for SECURITY.md in conda/.github#63

[jezdez]

Hold on, this isn't something we can just do for the whole org, conda/governance#166 is the blocker there

[jezdez]

@danyeaw Please remember that this repo is maintained on behalf of the conda steering council via the infrastructure subteam. If important topics like this come up, the first step is to make sure we report back the status, and in this case we haven't staffed a dedicated security subteam to do the work for the conda OSS org.

[jezdez]

I've left a comment to the steering council in conda/governance#166 (comment)