Add a coordinated vulnerability reporting policy

Open Beginner friendly
#411 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Documentation
Clarity
Mostly clear
Activity status
Active
Tech stack
github
Domain
documentation, security

Research direction

Check the repository’s existing contributor-facing documentation and GitHub’s private vulnerability reporting setting first. Add SECURITY.md with supported branches or releases, the private reporting path, required report details, exclusions for sensitive data, response expectations, and disclosure coordination. Link the policy from an appropriate contributor-facing location and verify each acceptance criterion is covered.

Written by the indexing model from the issue text.

Description

Why

TorBot is a widely used security and OSINT crawler that processes untrusted crawl content, but the default branch does not currently provide a SECURITY.md. Public issues are not an appropriate place for researchers to disclose crawler, dependency, or data-handling vulnerabilities.

A clear private reporting path would make responsible disclosure safer and give maintainers a consistent way to triage reports.

Proposed scope

  • Add a SECURITY.md to the default branch.
  • State which branches or releases currently receive security fixes.
  • Make GitHub private vulnerability reporting the preferred channel, enabling it if needed.
  • Define realistic, maintainer-approved acknowledgement and follow-up expectations.
  • Explain how disclosure coordination will work.
  • Warn reporters not to include credentials, private crawl targets, or sensitive crawl output in public issues.

Acceptance criteria

  • The repository exposes a clear private vulnerability-reporting path.
  • Supported versions or branches are documented.
  • Reporters know what information to include and what must stay out of public issues.
  • Response expectations are realistic and maintainable.
  • The policy is linked from an appropriate contributor-facing location.

Reference

GitHub's repository security guidance recommends documenting supported versions and how vulnerabilities should be reported:

https://docs.github.com/en/code-security/getting-started/quickstart-for-securing-your-repository

Dominant language
Python
Stars
4.9k
Forks
759
Avg merge
1d 2h
Merged PRs (30d)
2

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from DedSecInside/TorBot

All issues in DedSecInside/TorBot

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.