deal-with-security-advisory

Topics in the source

• Security Vulnerability Response Instructions
• ⚠️ CRITICAL: This is a security vulnerability. Everything about this process is confidential until the advisory is publi
• Context
• Step 0: Fetch the Advisory Details
• Step 1: Acknowledge the Report
• Step 2: Create the Temporary Private Fork
• Step 3: Develop and Validate the Fix
• Step 4: Coordinate with the Reporter

A security vulnerability has been reported via GitHub Security Advisory: Advisory: {{ghsaId}} (e.g. GHSA-x8hx-rhr2-9rf7) Reporter: {{reporterHandle}} Severity: {{severity}} Notes: {{notes}} Pull the full advisory so you understand the vulnerability before doing anything else: Read the description, severity, cvss, and vulnerabilities fields. Understand the attack vector before writing code. ⚠️ This step requires a human. The advisory thread does not have a comment API. Ask the human operator to post a comment on the private advisory thread acknowledging the report. Provide them this template: Thanks for the report, @{{reporterHandle}}. We've confirmed the issue and are working on a fix. We're targeting a patch release within {{timeframe}}. We'll keep you updated here. Give your human this template, but still continue Below we use gh tools - you do have access and credentials outside of your sandbox, so use them. This is where all fix development happens. Never push to the public repo. This returns a repository object for the private fork. Save the fullname and cloneurl. Clone it and set up your workspace: Do not edit /paperclip — the dev server is running off the /paperclip master b

This is an excerpt. Refer to the complete source and its current requirements.