You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@solr.apache.org by "Jan Høydahl (Jira)" <ji...@apache.org> on 2026/04/17 15:00:00 UTC
[jira] [Resolved] (SOLR-18193) Rewrite website security page and security reporting workflow
[ https://issues.apache.org/jira/browse/SOLR-18193?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Jan Høydahl resolved SOLR-18193.
--------------------------------
Resolution: Fixed
Resolved and pushed to staging site
* [https://solr.staged.apache.org/security.html]
> Rewrite website security page and security reporting workflow
> -------------------------------------------------------------
>
> Key: SOLR-18193
> URL: https://issues.apache.org/jira/browse/SOLR-18193
> Project: Solr
> Issue Type: Task
> Components: website
> Reporter: Jan Høydahl
> Assignee: Jan Høydahl
> Priority: Major
> Labels: pull-request-available
> Time Spent: 6h 10m
> Remaining Estimate: 0h
>
> The project keeps getting security reports to security@ mailing list, which of many do not obey by our instructions.
> The root cause may be that our security web page [https://solr.apache.org/security.html] is a mix of security news/announcements, false-positives/vex, description of our official security posture and step-by-step how to file a security report.
> The web page can be improved.
> * News section can go as a sub category of the NEWS page
> * The VEX stuff can be a separate sub page of security.html,
> * The main security.html could focus on what users should know, and what security researchers should prepare before reporting an issue.
> * The page could also benefit from a graphical diagram outlining the flow.
> When the PMC responds to incoming emails we need a set of well written canned responses for a few typical cases, like incomplete report, we don't like attachments to mail etc. Those canned responses could live in Wiki or as yet another sub page of the web page?
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org