From 09e35e7ac882496bb3a4fc0c4a5f9f70d297dd76 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Fri, 4 Apr 2025 12:59:49 +0200 Subject: [PATCH] Update bug report template for security issues MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Manuel Pégourié-Gonnard --- .github/ISSUE_TEMPLATE/bug_report.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md index c2031125ce..4f135f0a74 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.md +++ b/.github/ISSUE_TEMPLATE/bug_report.md @@ -7,6 +7,12 @@ assignees: '' --- +NOTE: if the bug you are reporting has or may have security implications, +we ask that you report it privately to + +so that we can prepare and release a fix before publishing the details. +See [SECURITY.md](https://github.com/Mbed-TLS/mbedtls/blob/development/SECURITY.md). + ### Summary @@ -25,6 +31,10 @@ Additional environment information: ### Actual behavior +NOTE: if the actual behaviour evokes memory corruption (like a crash or an error +from a memory checker), then the bug should be assumed to have security +implications (until proven otherwise), and we ask what you report it privately, +see the note at the some of this template. ### Steps to reproduce