Making the vulnerability reporting process more visible
Hi StarlingX community, The OpenDev team reached out to me this morning about someone reporting a vulnerability in Starlingx to them. I shared the link to the wiki page[1] that describes how to report a security vulnerability to the StarlingX VMT team. In an attempt to make the process more visible, I also added the link to the footer of the StarlingX website, with the label 'Security vulnerabilities'. Having this information part of the StarlingX documentation would likely help with the challenge of increasing its discoverability. That way we can have an item in the top-level ToC, so people can easily find what the process is, should they need to use it. What do you think? Thanks and Best Regards, Ildikó [1] https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_is... ——— Ildikó Váncsa Director of Community Open Infrastructure Foundation
Hi Ildiko, As the security PL, I support your proposal to make the process more visible. Regards, Ghada -----Original Message----- From: Ildiko Vancsa <ildiko@openinfra.dev> Sent: Monday, February 3, 2025 3:36 PM To: StarlingX ML <starlingx-discuss@lists.starlingx.io> Subject: Making the vulnerability reporting process more visible CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi StarlingX community, The OpenDev team reached out to me this morning about someone reporting a vulnerability in Starlingx to them. I shared the link to the wiki page[1] that describes how to report a security vulnerability to the StarlingX VMT team. In an attempt to make the process more visible, I also added the link to the footer of the StarlingX website, with the label 'Security vulnerabilities'. Having this information part of the StarlingX documentation would likely help with the challenge of increasing its discoverability. That way we can have an item in the top-level ToC, so people can easily find what the process is, should they need to use it. What do you think? Thanks and Best Regards, Ildikó [1] https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_is... ——— Ildikó Váncsa Director of Community Open Infrastructure Foundation
participants (2)
-
Ildiko Vancsa
-
Khalil, Ghada