Security: requesting a private channel to report a critical vulnerability (no details here)
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
从 repository 的 SECURITY.md 和 issue 中提到的 GitHub Security Advisories private-reporting 入口点开始。当启用私有渠道或提供私有安全联系人，以便可以共享被暂缓公开的漏洞报告、概念验证、拟议补丁和回归测试时，该 issue 即完成。
由索引模型根据 Issue 内容生成。
描述
Hi maintainers 👋
I've identified what I assess as a critical-severity security vulnerability in BitFun, reproduced against the current main branch.
I'm intentionally withholding all technical details here — no affected file, component, mechanism, or proof-of-concept — because publicly disclosing an unpatched issue would put current users at risk. This follows the project's own SECURITY.md / coordinated-disclosure policy.
I already have a complete report ready to share privately, including:
- Root-cause analysis and the exact location
- A working, self-contained proof-of-concept
- CVSS 3.1 scoring
- A proposed patch (diff) plus a regression test
What I need to proceed: a private channel. Right now the repo's /security/advisories/new link isn't usable by non-maintainers because Private Vulnerability Reporting appears to be disabled. Please do one of:
- Enable Private Vulnerability Reporting — repo Settings → Code security and analysis → Private vulnerability reporting → Enable. I'll then submit the full report through GitHub Security Advisories; or
- Reply with a private security contact (e.g. a security email) I can send the report to.
Once a private channel is open I'll hand over everything immediately, and I'm happy to coordinate a disclosure timeline after you've had a chance to review and patch.
Flagging as high priority given the severity. Thanks for building BitFun! 🙏
- 主要语言
- Rust
- 星标
- 2.3k
- 派生
- 236
- 平均合并
- 3 小时 33 分钟
- 30 天内合并 PR
- 339
环境准备
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
GCWing/OpenBitFun 的其他 Issue
-
难度 2/5 半天 新手友好度 74/100
GCWing/OpenBitFun#3279 ·
维护者通常 1 天内回复
-
[Bug]: 界面写“敏感诊断信息默认关闭”，但后端配置当前实际默认是 true可能已有人在做 @xiechimon 于 16 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 75/100
GCWing/OpenBitFun#3213 · 1 条评论 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
GCWing/OpenBitFun#2363 ·
维护者通常 1 天内回复
-
question
难度 1/5 1 小时以内 新手友好度 78/100
GCWing/OpenBitFun#2340 ·
维护者通常 1 天内回复
-
[Feature]: 用量提醒未关闭
难度 4/5 3-5 天 新手友好度 35/100
GCWing/OpenBitFun#3325 ·
维护者通常 1 天内回复
查看 GCWing/OpenBitFun 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 65/100
rescript-lang/rescript#8765 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 62/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 90/100
chroma-core/chroma#7879 ·
维护者通常 1 天内回复
-
priority middle
难度 1/5 1 小时以内 新手友好度 72/100
KATO-Hiro/AtCoderClans#12838 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复