From 7ae805765959c449bf350c2906440141d07cf661 Mon Sep 17 00:00:00 2001
From: Russ Cox
This document explains the Go Security team's process for handling issues
reported and what to expect in return.
All security bugs in the Go distribution should be reported by email to
@@ -31,7 +31,7 @@
security@golang.org.
Depending on the nature of your issue, it will be categorized by the Go
@@ -39,7 +39,7 @@
security issues will be issued CVE numbers.
Issues in the PUBLIC track affect niche configurations, have very limited
impact, or are already widely known.
@@ -85,7 +85,7 @@
-
Issues in the PRIVATE track are violations of committed security properties.
@@ -135,7 +135,7 @@
-
URGENT track issues are a threat to the Go ecosystem’s integrity, or are being
@@ -150,7 +150,7 @@
with no pre-announcement.
If you believe that an existing issue
@@ -160,7 +160,7 @@
according to this security policy.
The Go project uses the following disclosure process:Overview
+Overview
Reporting a Security Bug
+Reporting a Security Bug
Tracks
+Tracks
PUBLIC
+PUBLIC
PRIVATE
+PRIVATE
URGENT
+URGENT
Flagging Existing Issues as Security-related
+Flagging Existing Issues as Security-related
Disclosure Process
+Disclosure Process
The best way to receive security announcements is to subscribe to the
@@ -218,7 +218,7 @@
with [security]
.
If you have any suggestions to improve this policy, please