World map

 

BM

World 8: Shields: Security

SECURITY.md and advisories

You will learn: how to report security bugs privately, and how projects fix them.

The problem

You find a bug in a popular project. It leaks passwords. Do you post it in a public issue? Attackers read issues too.

Watch

A security policy (SECURITY.md): A file that tells people how to report security bugs privately. file tells people how to report security bugs privately. It’s like a README, just for security.

Try it

Give your diary a security policy. Write SECURITY.md, then commit it.

Working folder
  • Empty
Staging area
  • Empty
Repository
  • 3 save points
  • Ignore log files
  • Add day 1 page
  • Add README

Watch

A report comes in. Now the maintainers open a security advisory: A private space to fix a security bug, then a public warning about it.. It’s a private room. They talk, fix the bug, then publish a warning for everyone.

Try it

Put the safe way to handle a security bug in order. First at the top.

First step at the top. Put these in order. Use the arrows, or drag.

  • Maintainers open a draft advisory
  • They release the fixed version
  • Someone reports the bug privately
  • They publish the advisory
  • They fix it in private

Predict

The advisory is out. Your friend’s app still uses the old version. Who warns them?

Check

Good reporter, or needs work? Swipe each one.

Swipe right for good, left for needs work. Or use the buttons.

1 / 4

Follow the steps in SECURITY.md

You did it!

You can now handle security bugs the safe way.

Go deeper (optional)

Repo owners can turn on private vulnerability reporting. Then anyone can report straight into a draft advisory. Maintainers can fix the bug in a temporary private fork. They can also ask GitHub for a CVE id. That’s a worldwide name for the bug.