diff options
| author | Rich Trott <rtrott@gmail.com> | 2018-10-16 08:25:28 +0300 |
|---|---|---|
| committer | Myles Borins <mylesborins@google.com> | 2018-11-29 19:38:57 +0300 |
| commit | d81b143af038a2aa2361e8d2b5d7fab084f55bdd (patch) | |
| tree | 0fe57cce4b9fe95a8dd9234a41d963cdd9c6d750 /README.md | |
| parent | 232fe58a4cf67edad4f5c3a83104c2cfa5335451 (diff) | |
doc: simplify security reporting text
Edit security-reporting text in the README to keep it concise and
straightforward. The removed text may discourage reporting. Nothing like
it appears in similar security-reporting text that I have reviewed.
See, for example, the Linux kernel docs on security reporting:
https://www.kernel.org/doc/html/v4.11/admin-guide/security-bugs.html
PR-URL: https://github.com/nodejs/node/pull/23686
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 13 |
1 files changed, 4 insertions, 9 deletions
diff --git a/README.md b/README.md index ae2f28b2daf..00cbd58d532 100644 --- a/README.md +++ b/README.md @@ -166,15 +166,10 @@ team has addressed the vulnerability. The security team will acknowledge your email within 24 hours. You will receive a more detailed response within 48 hours. -There are no hard and fast rules to determine if a bug is worth reporting as -a security issue. The general rule is an issue worth reporting should allow an -attacker to compromise the confidentiality, integrity, or availability of the -Node.js application or its system for which the attacker does not already have -the capability. - -To illustrate the point, here are some examples of past issues and what the -Security Response Team thinks of them. When in doubt, however, please do send -us a report nonetheless. +There are no hard and fast rules to determine if a bug is worth reporting as a +security issue. Here are some examples of past issues and what the Security +Response Team thinks of them. When in doubt, please do send us a report +nonetheless. ### Public disclosure preferred |