41

If I find a security issue in a Github project should I raise it in the project's issue tracker (where it's open to public scrutiny) or try to find private means to contact the repo's maintainer so that action can be taken before the issue is exposed to public scrutiny?

3
  • 1
    This is actually a really interesting situation you got there. Problem is however, if the projects maintainer pushes a fix, chances are still high that attackers might latch on and still perform the attack on people that haven't upgraded. This will not however, be on your conscious, but on the project maintainer and the client.
    – Martijn
    Oct 12 '15 at 16:57
  • 1
    That's true but I guess all projects face that issue - look at node recently they patched a security hole and had to release the update then ask users to apply the update...same with shellshock etc
    – br3w5
    Oct 12 '15 at 17:22
  • You can retrieve most GitHub contributors' email address with this method. Apr 12 '19 at 17:41
28

There is, as far as I know, currently no way to mark an issue as a security issue. That makes reporting a security issue including full details on GitHub effectively a full disclosure strategy.

Different people support different ways of disclosure of security issues, and full disclosure is a valid choice.

However, if you don't want to go the full disclosure route, reporting an issue on GitHub which includes full details of the vulnerability is not possible.

You could choose to

  • Follow instructions for security vulnerabilities, if there are any
  • File an issue with your findings and a request to get in to contact
  • Find other means to contact the maintainer

The choice is yours.

4
  • 9
    Thanks I've raised an issue without any disclosure details and asked for a contact to go through it privately before adding anything else to github
    – br3w5
    Oct 12 '15 at 11:34
  • 5
    As a maintainer, I would much prefer you send that kind of issue privately, through our contact address. Of course, if the project doesn't have one, you've little choice but to publicly disclose it through the issue tracker.
    – RubberDuck
    Oct 12 '15 at 16:04
  • 2
    @RubberDuck If the project is on Github, then it has a Git repos by definition. And normally the addresses used in a VCS repository are valid email addresses. So one can write to those addresses. Nov 1 '15 at 13:03
  • Fantastic point @FaheemMitha. I believe that was pointed out elsewhere around here somewhere.
    – RubberDuck
    Nov 1 '15 at 13:09
16

All issues on Github are public. So, if the issue is one that is fine to disclose publicly, you could report it via the issue tracker.

However, as a general default, I would suggest trying to report the issue privately. I can suggest two options:

  • Look for a contact address for the maintainer. Perhaps if you are lucky it will be listed on the project web page. You can also use git log to see if an email address appears there.

  • If you cannot find a contact address, post a new issue on the issue tracker that says "I have a security vulnerability to report. How would you like me to report it? Please provide the appropriate contact information or instructions for where to report it." Then, wait for the maintainer to get back to you and describe how they'd like the issue to be reported.

1
  • 1
    good point often a contact email is in the authors section of package.json
    – br3w5
    Oct 12 '15 at 17:22
6

This is an old issue, but GitHub now recommends you to open a new issue on the related repository to ask for a preferred security contact:

If there isn't a security policy in place, the most efficient way to establish a private means of communication with maintainers is to create an issue asking for a preferred security contact. It's worth noting that the issue will be immediately publicly visible, so it should not include any information about the bug. Once communication is established, you can suggest the maintainers define a security policy for future use.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.