Cybersecurity
Oss SECURITY Disclosure
Runs coordinated vulnerability disclosure for an open-source project from the maintainer side: SECURITY.md and private reporting, triage and CVSS scoring, embargo timeline and reporter negotiation, CVE and CNA choice, patched releases across supported versions, downstream notice, EU CRA checks. Use whenever a maintainer gets a security report or disclosure deadline, or asks how to write SECURITY.md, enable private vulnerability reporting, request a CVE, publish an advisory, dispute a bogus CVE or answer a beg-bounty email about the project - even if they say someone found a hole in their library. Not for reporting a flaw in someone else's project, patching your dependencies' CVEs, or a closed-source product's VDP. Not the issue queue - use samber/developer-relations-skills@oss-issue-triage.
- Publisher / source
- samber/developer-relations-skills (found on skills.sh)
- Upstream record
- samber/developer-relations-skills
- Version
- Version 3
- Published
- Publication review
- Approved for publication
- Content fingerprint
a1457a03c38624a15306b4585b65da2086d5f6ee3725ecb4485119f538f09a3e