Skip to content

Add security documentation#403

Merged
JelleZijlstra merged 4 commits intopython:mainfrom
JelleZijlstra:securedocs
May 16, 2024
Merged

Add security documentation#403
JelleZijlstra merged 4 commits intopython:mainfrom
JelleZijlstra:securedocs

Conversation

@JelleZijlstra
Copy link
Copy Markdown
Member

Closes #393.

Copy link
Copy Markdown
Member

@AlexWaygood AlexWaygood left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be in SECURITY.md? (The guy in the talk we're in just now said that's where security researchers expect to find this kind of stuff)

@JelleZijlstra
Copy link
Copy Markdown
Member Author

@AlexWaygood I think we should also add SECURITY.md but I want to talk to someone (Seth?) to confirm the PSRT is OK with dealing with hypothetical security vulnerabilities in typing-extensions.

Copy link
Copy Markdown
Member

@AlexWaygood AlexWaygood left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it would probably be fine to add an incomplete SECURITY.md file (with this information in it) and extend it later. But this is also fine!

@hauntsaninja
Copy link
Copy Markdown
Collaborator

Let's merge this. We should also think about doing https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability

@JelleZijlstra
Copy link
Copy Markdown
Member Author

I enabled private vulnerability reporting and added a SECURITY.md pointing to it.

Co-authored-by: Alex Waygood <Alex.Waygood@Gmail.com>
@JelleZijlstra JelleZijlstra merged commit 910141a into python:main May 16, 2024
@JelleZijlstra JelleZijlstra deleted the securedocs branch May 16, 2024 20:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Improving the security of typing-extensions

3 participants