Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:116449
Message-ID: <ffca2057-ef58-7d6e-74ca-8abb8e90e80c@gmx.de>
Date: Thu, 18 Nov 2021 15:11:40 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101
 Thunderbird/91.3.1
Content-Language: de-DE
To: Matthew Weier O'Phinney <mweierophinney@gmail.com>,
 Nikita Popov <nikita.ppv@gmail.com>
Cc: Patrick ALLAERT <patrickallaert@php.net>,
 "Christoph M. Becker" <cmbecker69@gmx.de>,
 PHP internals <internals@lists.php.net>
References: <CAF+90c90pTtjxuMaQ88h+njhByfbv4qs=xx72CVPSw40tde6Cg@mail.gmail.com>
 <dde40b06-93c4-cb5b-0abf-48dfd8781fdf@telia.com>
 <CAF+90c_=GhEy0pX5wp9Hcj5+D31tjhhKBCSDCs4ofAoZj00_fA@mail.gmail.com>
 <25f35ef5-7f86-9aa3-a069-195a1ed39a91@gmx.de>
 <CACwt+JeLADQC6QvFt4m1gZCZ+oEeQnhSun-37T39bAR1N-uBjQ@mail.gmail.com>
 <CAF+90c9_u2BgDKywLMCfx9C3mFz-a-XZFeMe8NCvk8w4Fr1R0Q@mail.gmail.com>
 <CAJp_myWdQze1_WuL9ddDoi+1UTLUNz+9nU5_7hiKGG_-QhVqjg@mail.gmail.com>
In-Reply-To: <CAJp_myWdQze1_WuL9ddDoi+1UTLUNz+9nU5_7hiKGG_-QhVqjg@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [PHP-DEV] Re: [RFC] Migrating to GitHub issues
From: cmbecker69@gmx.de ("Christoph M. Becker")

On 18.11.2021 at 14:53, Matthew Weier O'Phinney wrote:

> With Laminas, we use an email alias to allow researchers to report to us=
.
> We then post the full report as a security issue on GitHub - it's a feat=
ure
> they rolled out late 2019/early 2020 that restricts visibility to
> maintainers initially, but allows inviting others to collaborate (we inv=
ite
> the reporter immediately, for instance). It also creates a private branc=
h
> for collaboration. When the patch has been merged, you can mark the issu=
e
> public.
>
> If the plan is to move to GH anyways, this could solve security reportin=
g.

Thanks!  I wasn't aware of that feature.  More info at
<https://docs.github.com/en/code-security/security-advisories/creating-a-s=
ecurity-advisory>.

=2D-
Christoph M. Becker