From dd4672607be88ba025afb3de11b92513f21e9042 Mon Sep 17 00:00:00 2001 From: TheFox0x7 Date: Sat, 7 Nov 2026 12:09:23 +0000 Subject: [PATCH] chore: add report requirements (#40262) Explicitly require version, reproduction and settings --------- Signed-off-by: silverwind Co-authored-by: silverwind --- SECURITY.md | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 5195370132e..169db7d4ad7 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -14,12 +14,28 @@ Reports must be filed against a supported version. Before reporting, verify that ## Reporting a Vulnerability -Please **DO NOT** file a public issue. Instead, report the vulnerability privately by opening a [GitHub security advisory](https://github.com/go-gitea/gitea/security/advisories/new), or optionally by sending your report to `security@gitea.io`. +Please **DO NOT** file a public issue. Instead, report the vulnerability privately by opening a [GitHub security advisory](https://github.com/go-gitea/gitea/security/advisories/new), or optionally by sending your report to `security@gitea.io`. Former is preferred if given a choice. If reporting via GitHub, open an advisory per found issue. You can group the found issues if they relate to a single area (same feature, same fault present in multiple routes) but do not group unrelated reports into one as it makes it much harder to assess and track for duplicates. Do not use LLM to write the reports. It's meant for people to read so take your time and use your own words to write it. If you have used LLM to find the bug, be transparent about it and verify that it is not hallucination before submitting the report. If your report turns out to be a duplicate, you will be credited in the original report. +### Report requirements + +When filing the report please document it. Reports must include: + +- Version or a range of versions it was successfully tested against. If reproducible against the `main` branch, a commit hash is also acceptable. Ambiguous versions like `latest` are not acceptable. +- Settings used, especially when they diverge from the defaults +- Reproduction steps from freshly installed instance. If the fault is only reproducible through upgrade from older version, reproduction should state that. + +Take your time to format it properly as it'll be much easier to read. Prefer a concise writing style. +When submitting an advisory, it should have the `gitea.dev` go package as package `name.cd` + +### Triage process + +Github does not have any search or tagging in GHSA so in most cases your report will leave triage state when we have a fix for it in works for next release. +This helps us keep track of items fixed and pending release and separate them from things that we either haven't looked at yet or have not fixed. + ## Protecting Security Information Due to the sensitive nature of security information, you can use the below GPG public key to encrypt your mail body.