Need documented process for identified security vulnerabilities

[MeltyBot]

Migrated from GitLab: https://gitlab.com/meltano/handbook/-/issues/7

Originally created by @aaronsteers on 2021-10-22 19:15:57

---

As follow-up to sdk#256 and the slack thread here, we've identified a gap in our process documentation for how to responsibly track, respond to, and disclose potential security vulnerabilities as we discover them.

The only documentation currently in the handbook does mention we will acknowledge the email disclosure (to the sender) "on the next business day" but not specifically how we will disclose.

Key things to evaluate:

1. When do we disclose a vulnerability and how.
2. If there are known exploits, how much information should be provided in publicly searchable issue descriptions.
3. What factors (if any) would lead to an issue being marked as confidential.
4. What are our internal procedures for quick-response risk assessment, sizing, and prioritization. I.e., can these happen in private forums (such as slack or zoom), and what needs to be shared back with the community.

These are questions others have had to answer, and I (AJ) would like as much as possible to lean on industry best practice, where available. Following from this, I think the first step is to locate a few other internal guidelines and procedures from established tech companies and see how they compare/contrast from each other.

Note: This is not a confidential issue; anyone can view and engage in the discussion here.

---

What I found as of today for this process:

• https://meltano.com/docs/responsible-disclosure.html

Please email [email protected] to report any security vulnerabilities. We will acknowledge receipt of your vulnerability report the next business day and strive to send you regular updates about our progress. If you're curious about the status of your disclosure please feel free to email us again.

• https://gitlab.com/meltano/handbook/-/tree/master/src/_support#responsible-disclosure-of-security-vulnerabilities

Emails to [email protected] also forward to Zendesk, and are automatically assigned to the Security group, which includes all current team members. As documented in our Responsible Disclosure Policy, we will acknowledge receipt of a vulnerability report the next business day and strive to send the reporter regular updates about our progress.

[MeltyBot]

View 1 previous comment from the original issue on GitLab