You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@fluss.apache.org by "matrixsparse (via GitHub)" <gi...@apache.org> on 2026/04/17 19:09:20 UTC
[PR] [docs] Add security reporting documentation [fluss]
matrixsparse opened a new pull request, #3120:
URL: https://github.com/apache/fluss/pull/3120
## What is the purpose of the change
This PR adds a security page describing how to report security issues to the Apache Security Team, satisfying the maturity assessment QU30 requirement.
## Brief change log
- Add `website/community/security.md` with security reporting guidelines
- Reference Paimon and OpenDAL's security page structure and wording
## Verifying this change
- [ ] Preview the documentation locally using `npm start` in the website directory
- [ ] Verify the Security page appears in the Community sidebar
## Does this pull request introduce a breaking change?
- [x] No
## Documentation
- New documentation added: `security.md`
Closes #3074
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [docs] Add security reporting documentation [fluss]
Posted by "matrixsparse (via GitHub)" <gi...@apache.org>.
matrixsparse commented on PR #3120:
URL: https://github.com/apache/fluss/pull/3120#issuecomment-4281632533
Hi @luoyuxia, Updated the wording as suggested. PTAL
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [docs] Add security reporting documentation [fluss]
Posted by "luoyuxia (via GitHub)" <gi...@apache.org>.
luoyuxia merged PR #3120:
URL: https://github.com/apache/fluss/pull/3120
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [docs] Add security reporting documentation [fluss]
Posted by "luoyuxia (via GitHub)" <gi...@apache.org>.
luoyuxia commented on PR #3120:
URL: https://github.com/apache/fluss/pull/3120#issuecomment-4278560431
@matrixsparse Hi, lgtm to overall. But seems copilot suggestion make it clear.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [docs] Add security reporting documentation [fluss]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #3120:
URL: https://github.com/apache/fluss/pull/3120#discussion_r3108802677
##########
website/community/security.md:
##########
@@ -0,0 +1,14 @@
+---
+title: Security
+sidebar_position: 8
+---
+
+# Security
+
+## Reporting Security Issues
+
+If you have apprehensions regarding Fluss's security or you discover vulnerability or potential threat, don't hesitate to get in touch with the Apache Security Team by dropping a mail at **security@apache.org**.
+
+In the mail, specify the project name **Fluss** with the description of the issue or potential threat. You are also urged to recommend the way to reproduce and replicate the issue. The security team and the Fluss community will get back to you after assessing and analysing the findings.
+
+**PLEASE PAY ATTENTION** to report the security issue on the security email before disclosing it on public domain.
Review Comment:
Several phrases are ungrammatical/awkward and may reduce clarity for a security-reporting process (e.g., missing articles, wrong prepositions, and mixed wording). Consider rewriting for clear, precise instructions (e.g., 'discover a vulnerability or potential threat', 'send an email', 'include reproduction steps', 'before disclosing publicly').
```suggestion
If you have concerns regarding Fluss's security or discover a vulnerability or potential threat, please contact the Apache Security Team by sending an email to **security@apache.org**.
In the email, specify the project name **Fluss** and include a description of the issue or potential threat. You are also encouraged to include steps to reproduce the issue. The security team and the Fluss community will get back to you after assessing and analyzing the findings.
**PLEASE PAY ATTENTION** to report the security issue to the security email address before disclosing it publicly.
```
##########
website/community/security.md:
##########
@@ -0,0 +1,14 @@
+---
+title: Security
+sidebar_position: 8
+---
+
+# Security
+
+## Reporting Security Issues
+
+If you have apprehensions regarding Fluss's security or you discover vulnerability or potential threat, don't hesitate to get in touch with the Apache Security Team by dropping a mail at **security@apache.org**.
+
+In the mail, specify the project name **Fluss** with the description of the issue or potential threat. You are also urged to recommend the way to reproduce and replicate the issue. The security team and the Fluss community will get back to you after assessing and analysing the findings.
+
+**PLEASE PAY ATTENTION** to report the security issue on the security email before disclosing it on public domain.
Review Comment:
The instruction is unclear and uses non-idiomatic wording ('on the security email', 'on public domain'). For documentation that may be referenced during incidents, use explicit, unambiguous language (e.g., 'Please report security issues privately to security@apache.org before disclosing publicly'). This reduces the chance of accidental public disclosure.
```suggestion
**PLEASE PAY ATTENTION** to report the security issue privately to **security@apache.org** before disclosing it publicly.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fluss.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org