If I find a security issue in a Github project should I raise it in the project's issue tracker (where it's open to public scrutiny) or try to find private means to contact the repo's maintainer so that action can be taken before the issue is exposed to public scrutiny?
There is, as far as I know, currently no way to mark an issue as a security issue. That makes reporting a security issue including full details on GitHub effectively a full disclosure strategy.
Different people support different ways of disclosure of security issues, and full disclosure is a valid choice.
However, if you don't want to go the full disclosure route, reporting an issue on GitHub which includes full details of the vulnerability is not possible.
You could choose to
- Follow instructions for security vulnerabilities, if there are any
- File an issue with your findings and a request to get in to contact
- Find other means to contact the maintainer
The choice is yours.
All issues on Github are public. So, if the issue is one that is fine to disclose publicly, you could report it via the issue tracker.
However, as a general default, I would suggest trying to report the issue privately. I can suggest two options:
Look for a contact address for the maintainer. Perhaps if you are lucky it will be listed on the project web page. You can also use
git logto see if an email address appears there.
If you cannot find a contact address, post a new issue on the issue tracker that says "I have a security vulnerability to report. How would you like me to report it? Please provide the appropriate contact information or instructions for where to report it." Then, wait for the maintainer to get back to you and describe how they'd like the issue to be reported.