You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "o-nikolas (via GitHub)" <gi...@apache.org> on 2023/07/10 16:59:05 UTC
[GitHub] [airflow] o-nikolas commented on a diff in pull request #32439: Add few clarifications to our security policy
o-nikolas commented on code in PR #32439:
URL: https://github.com/apache/airflow/pull/32439#discussion_r1258597215
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain list of
+dependencies of Airflow with dependencies in Airflow Docker reference image - there
+is a page that describes how the
+[Airflow reference Image is fixed at release time](https://airflow.apache.org/docs/docker-stack/index.html#fixing-images-at-release-time)
+and providing helpful instructions explaining how you can build your
+own image and manage dependencies of Airflow in your own image.
+
+**Please send one plain-text email for each vulnerability you are reporting including explanation
+how it affects airflow security. We may ask you to resubmit your report if you send it as an image,
Review Comment:
```suggestion
**Please send one plain-text email for each vulnerability you are reporting including an explanation
of how it affects Airflow security. We may ask that you resubmit your report if you send it as an image,
```
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain list of
Review Comment:
```suggestion
Specifically, we will ignore results of security scans that contain a list of
```
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
Review Comment:
```suggestion
**Only** use the security e-mail address to report undisclosed security vulnerabilities in Apache
Airflow and to manage the process of fixing such vulnerabilities. We do not accept regular
bug reports or other security-related queries at this address. We will ignore mail
sent to this address that does not relate to an undisclosed security problem
```
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain list of
+dependencies of Airflow with dependencies in Airflow Docker reference image - there
+is a page that describes how the
+[Airflow reference Image is fixed at release time](https://airflow.apache.org/docs/docker-stack/index.html#fixing-images-at-release-time)
+and providing helpful instructions explaining how you can build your
+own image and manage dependencies of Airflow in your own image.
+
+**Please send one plain-text email for each vulnerability you are reporting including explanation
Review Comment:
What's the background on why we demand this? I have found it very helpful when images or detailed documents have been included with the report.
##########
.github/SECURITY.md:
##########
@@ -31,14 +31,25 @@ Airflow specifically offers security features and is responsive to issues
around its features. If you have any concern around Airflow Security or believe
you have uncovered a vulnerability, we suggest that you get in touch via the
e-mail address [security@airflow.apache.org](mailto:security@airflow.apache.org).
-In the message, try to provide a description of the issue and ideally a way of
-reproducing it. The security team will get back to you after assessing the report.
-Note that this security address should be used only for undisclosed
-vulnerabilities. Dealing with fixed issues or general questions on how to use
-the security features should be handled regularly via the user and the dev
-lists. Please report any security problems to the project security address
-before disclosing it publicly.
+**Only** use the security contacts to report undisclosed security vulnerabilities in Apache
+Airflow and manage the process of fixing such vulnerabilities. We cannot accept regular
+bug reports or other security-related queries at these addresses. We will ignore mail
+sent to this address that does not relate to an undisclosed security problem
+in the Apache Airflow project. Please follow regular communication channels described in
+the [Airflow Community](https://airflow.apache.org/community/index.html) page for
+inquiries, questions and other discussions related to the process or issues.
+
+Specifically, we will ignore results of security scans that contain list of
+dependencies of Airflow with dependencies in Airflow Docker reference image - there
+is a page that describes how the
+[Airflow reference Image is fixed at release time](https://airflow.apache.org/docs/docker-stack/index.html#fixing-images-at-release-time)
+and providing helpful instructions explaining how you can build your
+own image and manage dependencies of Airflow in your own image.
+
+**Please send one plain-text email for each vulnerability you are reporting including explanation
+how it affects airflow security. We may ask you to resubmit your report if you send it as an image,
+movie, HTML, or PDF attachment when you could as easily describe it with plain text.**
Review Comment:
```suggestion
movie, HTML, or PDF attachment when you could as easily describe it with plain text.**
```
##########
.github/SECURITY.md:
##########
@@ -49,7 +60,11 @@ in other products/circumstances. Therefore, some potential security vulnerabilit
apply to Airflow, or have a different severity than some generic scoring systems (for example `CVSS`)
calculation suggests.
-The [ASF Security team's page](https://www.apache.org/security/) describes
+The security team (see below [Handling security issues in Airflow](https://github.com/apache/airflow/security#handling-security-issues-in-airflow)) will get back to
+you after assessing the report.
Review Comment:
```suggestion
The security team will get back to you after assessing the report (see below [Handling security issues in Airflow](https://github.com/apache/airflow/security#handling-security-issues-in-airflow)).
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org