Security Policy for contrib app: security contact clarification

Hi everyone,

I’m opening this brainstorming as a follow up of Security policy: handling of contrib extensions not properly maintained - #13 by surli in which latest proposal mention:

Send a direct email to the maintainer to ensure the maintainer is aware of the security vulnerability

And I started to wonder myself how we should find that email in a reliable way.

Right now we have different sources of information about people who maintain an extension:

  1. the extension page contains a “developed by” list of users
  2. the repository README generally has information about a leader
  3. the JIRA project has a leader

I would use 2, but I’m pretty sure the info is never updated even so extensions evolved: e.g. the same repo is used to add new extensions (like for JIRA extensions). It’s same for 3. And 1 is the list of people who contributed, not the actual person that are willing to hold responsibility for handling security issues.

Also even if we consider 1 and 2 are reliable, I have the feeling that it would make sense to consolidate that info in the extension page: nothing prevents to delete the Github repository or the JIRA project for example.

Another idea (which doesn’t contradict what I just proposed) would be to also have an email security contact in the extension page: we could imagine this email to be a different person. E.g. we consider I am leader for Change Request extension but that any committer to answer in case of security issue and to provide that email / contact.

So wdyt about:

  1. exposing the project leader in the extension page
  2. exposing a security contact in the extension page

And each commit in git contains the email of the committer.