Hi maintainers,
Sa-Token's Security tab currently shows GitHub's "Suggest a security policy" prompt — there's no SECURITY.md and Private Vulnerability Reporting (PVR) is disabled.
I checked the API:
GET /repos/dromara/Sa-Token/private-vulnerability-reporting
=> {"enabled": false}
This makes responsible disclosure awkward, because the only options researchers have right now are (a) post in a public issue (which gives attackers a head-start before a fix lands) or (b) try to find a maintainer email. Many other dromara projects are in the same state, so this is an org-wide gap rather than a Sa-Token-specific one.
Two options I'd love your help with:
- Option A (preferred): Enable Private Vulnerability Reporting via Settings → Code security → Private vulnerability reporting → Enable. Free for public repos, hides triage discussion from the public, and gives researchers a structured GHSA channel.
- Option B: Confirm a preferred private channel (email or otherwise) and I can route there.
I've also opened a companion PR adding a draft SECURITY.md based on the standard GitHub template (with sections tailored for an auth/SSO framework). It's purely the "Suggest a security policy" suggestion — feel free to edit anything in it; the important thing is that a private reporting channel exists.
For context on why I'm asking: this is part of a broader coordinated-disclosure campaign that has filed advisories across many maintainer orgs over the past weeks; everything has been routed through private channels (PVR/email) with no public weaponization. I'd like to follow the same pattern for any future Sa-Token findings.
Thanks for considering!
— Eddie Ran
Hi maintainers,
Sa-Token's Security tab currently shows GitHub's "Suggest a security policy" prompt — there's no
SECURITY.mdand Private Vulnerability Reporting (PVR) is disabled.I checked the API:
This makes responsible disclosure awkward, because the only options researchers have right now are (a) post in a public issue (which gives attackers a head-start before a fix lands) or (b) try to find a maintainer email. Many other dromara projects are in the same state, so this is an org-wide gap rather than a Sa-Token-specific one.
Two options I'd love your help with:
I've also opened a companion PR adding a draft
SECURITY.mdbased on the standard GitHub template (with sections tailored for an auth/SSO framework). It's purely the "Suggest a security policy" suggestion — feel free to edit anything in it; the important thing is that a private reporting channel exists.For context on why I'm asking: this is part of a broader coordinated-disclosure campaign that has filed advisories across many maintainer orgs over the past weeks; everything has been routed through private channels (PVR/email) with no public weaponization. I'd like to follow the same pattern for any future Sa-Token findings.
Thanks for considering!
— Eddie Ran