31

If I find a security issue in a Github project should I raise it in the project's issue tracker (where it's open to public scrutiny) or try to find private means to contact the repo's maintainer so that action can be taken before the issue is exposed to public scrutiny?

  • 1
    This is actually a really interesting situation you got there. Problem is however, if the projects maintainer pushes a fix, chances are still high that attackers might latch on and still perform the attack on people that haven't upgraded. This will not however, be on your conscious, but on the project maintainer and the client. – Martijn Oct 12 '15 at 16:57
  • 1
    That's true but I guess all projects face that issue - look at node recently they patched a security hole and had to release the update then ask users to apply the update...same with shellshock etc – br3w5 Oct 12 '15 at 17:22
  • You can retrieve most GitHub contributors' email address with this method. – sondra.kinsey Apr 12 at 17:41
21

There is, as far as I know, currently no way to mark an issue as a security issue. That makes reporting a security issue including full details on GitHub effectively a full disclosure strategy.

Different people support different ways of disclosure of security issues, and full disclosure is a valid choice.

However, if you don't want to go the full disclosure route, reporting an issue on GitHub which includes full details of the vulnerability is not possible.

You could choose to

  • Follow instructions for security vulnerabilities, if there are any
  • File an issue with your findings and a request to get in to contact
  • Find other means to contact the maintainer

The choice is yours.

  • 9
    Thanks I've raised an issue without any disclosure details and asked for a contact to go through it privately before adding anything else to github – br3w5 Oct 12 '15 at 11:34
  • 5
    As a maintainer, I would much prefer you send that kind of issue privately, through our contact address. Of course, if the project doesn't have one, you've little choice but to publicly disclose it through the issue tracker. – RubberDuck Oct 12 '15 at 16:04
  • 2
    @RubberDuck If the project is on Github, then it has a Git repos by definition. And normally the addresses used in a VCS repository are valid email addresses. So one can write to those addresses. – Faheem Mitha Nov 1 '15 at 13:03
  • Fantastic point @FaheemMitha. I believe that was pointed out elsewhere around here somewhere. – RubberDuck Nov 1 '15 at 13:09
11

All issues on Github are public. So, if the issue is one that is fine to disclose publicly, you could report it via the issue tracker.

However, as a general default, I would suggest trying to report the issue privately. I can suggest two options:

  • Look for a contact address for the maintainer. Perhaps if you are lucky it will be listed on the project web page. You can also use git log to see if an email address appears there.

  • If you cannot find a contact address, post a new issue on the issue tracker that says "I have a security vulnerability to report. How would you like me to report it? Please provide the appropriate contact information or instructions for where to report it." Then, wait for the maintainer to get back to you and describe how they'd like the issue to be reported.

  • 1
    good point often a contact email is in the authors section of package.json – br3w5 Oct 12 '15 at 17:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.