Hi everyone,
I’m opening this brainstorming as a follow up of Security policy: handling of contrib extensions not properly maintained - #13 by surli in which latest proposal mention:
Send a direct email to the maintainer to ensure the maintainer is aware of the security vulnerability
And I started to wonder myself how we should find that email in a reliable way.
Right now we have different sources of information about people who maintain an extension:
- the extension page contains a “developed by” list of users
- the repository README generally has information about a leader
- the JIRA project has a leader
I would use 2, but I’m pretty sure the info is never updated even so extensions evolved: e.g. the same repo is used to add new extensions (like for JIRA extensions). It’s same for 3. And 1 is the list of people who contributed, not the actual person that are willing to hold responsibility for handling security issues.
Also even if we consider 1 and 2 are reliable, I have the feeling that it would make sense to consolidate that info in the extension page: nothing prevents to delete the Github repository or the JIRA project for example.
Another idea (which doesn’t contradict what I just proposed) would be to also have an email security contact in the extension page: we could imagine this email to be a different person. E.g. we consider I am leader for Change Request extension but that any committer to answer in case of security issue and to provide that email / contact.
So wdyt about:
- exposing the project leader in the extension page
- exposing a security contact in the extension page