If I find a security issue in a Github project should I raise it in the project's issue tracker (where it's open to public scrutiny) or try to find private means to contact the repo's maintainer so that action can be taken before the issue is exposed to public scrutiny?
There is, as far as I know, currently no way to mark an issue as a security issue. That makes reporting a security issue including full details on GitHub effectively a full disclosure strategy.
Different people support different ways of disclosure of security issues, and full disclosure is a valid choice.
However, if you don't want to go the full disclosure route, reporting an issue on GitHub which includes full details of the vulnerability is not possible.
You could choose to
- Follow instructions for security vulnerabilities, if there are any
- File an issue with your findings and a request to get in to contact
- Find other means to contact the maintainer
The choice is yours.
All issues on Github are public. So, if the issue is one that is fine to disclose publicly, you could report it via the issue tracker.
However, as a general default, I would suggest trying to report the issue privately. I can suggest two options:
Look for a contact address for the maintainer. Perhaps if you are lucky it will be listed on the project web page. You can also use
git logto see if an email address appears there.
If you cannot find a contact address, post a new issue on the issue tracker that says "I have a security vulnerability to report. How would you like me to report it? Please provide the appropriate contact information or instructions for where to report it." Then, wait for the maintainer to get back to you and describe how they'd like the issue to be reported.
This is an old issue, but GitHub now recommends you to open a new issue on the related repository to ask for a preferred security contact:
If there isn't a security policy in place, the most efficient way to establish a private means of communication with maintainers is to create an issue asking for a preferred security contact. It's worth noting that the issue will be immediately publicly visible, so it should not include any information about the bug. Once communication is established, you can suggest the maintainers define a security policy for future use.