Talip7/scikit-learn-issues-multilabel huggingface dataset:
DOC Managing huntr security vulnerability reports

### Describe the issue linked to the documentation

### Issues
- The project receives reports from huntr that are not useful.
- The reports from huntr are time consuming and use up limited maintainer resources.

### Discussion / Proposal
- Update our [SECURITY.md](http://security.md/) file to indicate how we are dealing with huntr reports
- Direct security reporters to provide more detailed information on security vulnerability including proof of concept (POC) and proof of impact (POI)
- Once POC and POI is established, can direct people to report issue via the GitHub Security Advisory: https://github.com/scikit-learn/scikit-learn/security/advisories/new
- Remove scikit-learn from the huntr bug bounty program


### Proposed text for huntr reports
Draft text for huntr submissions: 
>The scikit-learn project is not reviewing reports submitted to huntr. Please use our SECURITY.md to submit reports. For security reports, provide both a POC (proof of concept) and POI (proof of impact). If your report is deemed impactful, you can then report it to huntr to collect a bounty.

### References
- [Scientific Python SPEC](https://github.com/scientific-python/specs/pull/391/)
- [NumPy discussion on security](https://github.com/numpy/numpy/issues/29178)
- [Dask: comment from huntr person](https://github.com/dask/community/issues/415#issuecomment-2755046159)

### Suggest a potential alternative/fix

_No response_

COMMENT:
Hi! I’d like to work on this issue. I’m new to open source and happy to help. Thanks!

Labels: Documentation, Needs Investigation
DOC Managing huntr security vulnerability reports

### Describe the issue linked to the documentation

### Issues
- The project receives reports from huntr that are not useful.
- The reports from huntr are time consuming and use up limited maintainer resources.

### Discussion / Proposal
- Update our [SECURITY.md](http://security.md/) file to indicate how we are dealing with huntr reports
- Direct security reporters to provide more detailed information on security vulnerability including proof of concept (POC) and proof of impact (POI)
- Once POC and POI is established, can direct people to report issue via the GitHub Security Advisory: https://github.com/scikit-learn/scikit-learn/security/advisories/new
- Remove scikit-learn from the huntr bug bounty program


### Proposed text for huntr reports
Draft text for huntr submissions: 
>The scikit-learn project is not reviewing reports submitted to huntr. Please use our SECURITY.md to submit reports. For security reports, provide both a POC (proof of concept) and POI (proof of impact). If your report is deemed impactful, you can then report it to huntr to collect a bounty.

### References
- [Scientific Python SPEC](https://github.com/scientific-python/specs/pull/391/)
- [NumPy discussion on security](https://github.com/numpy/numpy/issues/29178)
- [Dask: comment from huntr person](https://github.com/dask/community/issues/415#issuecomment-2755046159)

### Suggest a potential alternative/fix

_No response_

COMMENT:
Thank you for your interest in contributing, @Hatice-Kocabas!

This issue requires careful triage and specific knowledge of open-source security, which may not be ideal for first-time contributors.

I'd recommend checking out our [list of good first issues](https://github.com/scikit-learn/scikit-learn/issues?q=is%3Aissue%20state%3Aopen%20label%3A%22good%20first%20issue%22), particularly #30621. These are handpicked to help new contributors get familiar with the codebase and contribution process.

Labels: Documentation, Needs Investigation
DOC Managing huntr security vulnerability reports

### Describe the issue linked to the documentation

### Issues
- The project receives reports from huntr that are not useful.
- The reports from huntr are time consuming and use up limited maintainer resources.

### Discussion / Proposal
- Update our [SECURITY.md](http://security.md/) file to indicate how we are dealing with huntr reports
- Direct security reporters to provide more detailed information on security vulnerability including proof of concept (POC) and proof of impact (POI)
- Once POC and POI is established, can direct people to report issue via the GitHub Security Advisory: https://github.com/scikit-learn/scikit-learn/security/advisories/new
- Remove scikit-learn from the huntr bug bounty program


### Proposed text for huntr reports
Draft text for huntr submissions: 
>The scikit-learn project is not reviewing reports submitted to huntr. Please use our SECURITY.md to submit reports. For security reports, provide both a POC (proof of concept) and POI (proof of impact). If your report is deemed impactful, you can then report it to huntr to collect a bounty.

### References
- [Scientific Python SPEC](https://github.com/scientific-python/specs/pull/391/)
- [NumPy discussion on security](https://github.com/numpy/numpy/issues/29178)
- [Dask: comment from huntr person](https://github.com/dask/community/issues/415#issuecomment-2755046159)

### Suggest a potential alternative/fix

_No response_

COMMENT:
@reshamas I guess if you find the time and motivation, you may want to try to contact Huntr via the email in the [Dask issue](https://github.com/dask/community/issues/415#issuecomment-2755046159) and ask them to stop accepting reports on scikit-learn.

Apparently Tensorflow managed to get off Huntr after some time and insistence according to this [Discord message](https://discord.com/channels/786703927705862175/1382247431198212096/1382566780710555689) so it looks like it's possible ...

Labels: Documentation, Needs Investigation
DOC Managing huntr security vulnerability reports

### Describe the issue linked to the documentation

### Issues
- The project receives reports from huntr that are not useful.
- The reports from huntr are time consuming and use up limited maintainer resources.

### Discussion / Proposal
- Update our [SECURITY.md](http://security.md/) file to indicate how we are dealing with huntr reports
- Direct security reporters to provide more detailed information on security vulnerability including proof of concept (POC) and proof of impact (POI)
- Once POC and POI is established, can direct people to report issue via the GitHub Security Advisory: https://github.com/scikit-learn/scikit-learn/security/advisories/new
- Remove scikit-learn from the huntr bug bounty program


### Proposed text for huntr reports
Draft text for huntr submissions: 
>The scikit-learn project is not reviewing reports submitted to huntr. Please use our SECURITY.md to submit reports. For security reports, provide both a POC (proof of concept) and POI (proof of impact). If your report is deemed impactful, you can then report it to huntr to collect a bounty.

### References
- [Scientific Python SPEC](https://github.com/scientific-python/specs/pull/391/)
- [NumPy discussion on security](https://github.com/numpy/numpy/issues/29178)
- [Dask: comment from huntr person](https://github.com/dask/community/issues/415#issuecomment-2755046159)

### Suggest a potential alternative/fix

_No response_

COMMENT:
I have GH security advisory for `skops` and it's working quite fine. So I'd be happy to have the same here.

We can also simply close everything coming through huntr, and write that we only accept reports through GH security advisory.

Labels: Documentation, Needs Investigation
DOC Managing huntr security vulnerability reports

### Describe the issue linked to the documentation

### Issues
- The project receives reports from huntr that are not useful.
- The reports from huntr are time consuming and use up limited maintainer resources.

### Discussion / Proposal
- Update our [SECURITY.md](http://security.md/) file to indicate how we are dealing with huntr reports
- Direct security reporters to provide more detailed information on security vulnerability including proof of concept (POC) and proof of impact (POI)
- Once POC and POI is established, can direct people to report issue via the GitHub Security Advisory: https://github.com/scikit-learn/scikit-learn/security/advisories/new
- Remove scikit-learn from the huntr bug bounty program


### Proposed text for huntr reports
Draft text for huntr submissions: 
>The scikit-learn project is not reviewing reports submitted to huntr. Please use our SECURITY.md to submit reports. For security reports, provide both a POC (proof of concept) and POI (proof of impact). If your report is deemed impactful, you can then report it to huntr to collect a bounty.

### References
- [Scientific Python SPEC](https://github.com/scientific-python/specs/pull/391/)
- [NumPy discussion on security](https://github.com/numpy/numpy/issues/29178)
- [Dask: comment from huntr person](https://github.com/dask/community/issues/415#issuecomment-2755046159)

### Suggest a potential alternative/fix

_No response_

COMMENT:
> I have GH security advisory for skops and it's working quite fine. So I'd be happy to have the same here.

We already have GHSA set-up for scikit-learn as mentioned in our [`SECURITY.md`](https://github.com/scikit-learn/scikit-learn/blob/main/SECURITY.md).

> We can also simply close everything coming through huntr, and write that we only accept reports through GH security advisory.

I don't think there is a way to close a report in Huntr without making it public.

Labels: Documentation, Needs Investigation
DOC Managing huntr security vulnerability reports

### Describe the issue linked to the documentation

### Issues
- The project receives reports from huntr that are not useful.
- The reports from huntr are time consuming and use up limited maintainer resources.

### Discussion / Proposal
- Update our [SECURITY.md](http://security.md/) file to indicate how we are dealing with huntr reports
- Direct security reporters to provide more detailed information on security vulnerability including proof of concept (POC) and proof of impact (POI)
- Once POC and POI is established, can direct people to report issue via the GitHub Security Advisory: https://github.com/scikit-learn/scikit-learn/security/advisories/new
- Remove scikit-learn from the huntr bug bounty program


### Proposed text for huntr reports
Draft text for huntr submissions: 
>The scikit-learn project is not reviewing reports submitted to huntr. Please use our SECURITY.md to submit reports. For security reports, provide both a POC (proof of concept) and POI (proof of impact). If your report is deemed impactful, you can then report it to huntr to collect a bounty.

### References
- [Scientific Python SPEC](https://github.com/scientific-python/specs/pull/391/)
- [NumPy discussion on security](https://github.com/numpy/numpy/issues/29178)
- [Dask: comment from huntr person](https://github.com/dask/community/issues/415#issuecomment-2755046159)

### Suggest a potential alternative/fix

_No response_

COMMENT:
Then we just tell them we're not going to be looking at them?

Labels: Documentation, Needs Investigation
DOC Managing huntr security vulnerability reports

### Describe the issue linked to the documentation

### Issues
- The project receives reports from huntr that are not useful.
- The reports from huntr are time consuming and use up limited maintainer resources.

### Discussion / Proposal
- Update our [SECURITY.md](http://security.md/) file to indicate how we are dealing with huntr reports
- Direct security reporters to provide more detailed information on security vulnerability including proof of concept (POC) and proof of impact (POI)
- Once POC and POI is established, can direct people to report issue via the GitHub Security Advisory: https://github.com/scikit-learn/scikit-learn/security/advisories/new
- Remove scikit-learn from the huntr bug bounty program


### Proposed text for huntr reports
Draft text for huntr submissions: 
>The scikit-learn project is not reviewing reports submitted to huntr. Please use our SECURITY.md to submit reports. For security reports, provide both a POC (proof of concept) and POI (proof of impact). If your report is deemed impactful, you can then report it to huntr to collect a bounty.

### References
- [Scientific Python SPEC](https://github.com/scientific-python/specs/pull/391/)
- [NumPy discussion on security](https://github.com/numpy/numpy/issues/29178)
- [Dask: comment from huntr person](https://github.com/dask/community/issues/415#issuecomment-2755046159)

### Suggest a potential alternative/fix

_No response_

COMMENT:
It used to be the case that if you don't take action on a Huntr report, it will be made public after ~3 months and a CVE will be issued, which then turns into a nightmare. This is what happened in the Dask case and this [comment](https://github.com/dask/community/issues/415#issuecomment-2755046159) seems to say that Huntr will stop doing that and ask for maintainers input but honestly I am not willing to take a bet based on this comment ...

Basically we don't have that many Huntr reports so I would keep replying to them in Huntr and longer-term try to contact Huntr so that scikit-learn is removed from their platform.

Labels: Documentation, Needs Investigation
DOC Managing huntr security vulnerability reports

### Describe the issue linked to the documentation

### Issues
- The project receives reports from huntr that are not useful.
- The reports from huntr are time consuming and use up limited maintainer resources.

### Discussion / Proposal
- Update our [SECURITY.md](http://security.md/) file to indicate how we are dealing with huntr reports
- Direct security reporters to provide more detailed information on security vulnerability including proof of concept (POC) and proof of impact (POI)
- Once POC and POI is established, can direct people to report issue via the GitHub Security Advisory: https://github.com/scikit-learn/scikit-learn/security/advisories/new
- Remove scikit-learn from the huntr bug bounty program


### Proposed text for huntr reports
Draft text for huntr submissions: 
>The scikit-learn project is not reviewing reports submitted to huntr. Please use our SECURITY.md to submit reports. For security reports, provide both a POC (proof of concept) and POI (proof of impact). If your report is deemed impactful, you can then report it to huntr to collect a bounty.

### References
- [Scientific Python SPEC](https://github.com/scientific-python/specs/pull/391/)
- [NumPy discussion on security](https://github.com/numpy/numpy/issues/29178)
- [Dask: comment from huntr person](https://github.com/dask/community/issues/415#issuecomment-2755046159)

### Suggest a potential alternative/fix

_No response_

COMMENT:
We can also just mark everything as "waste of time" and leave a comment that they can report on GH, and let huntr know that if they want us to keep supporting them, they should be paying the maintainers as well as the reporters?

Labels: Documentation, Needs Investigation
DOC Managing huntr security vulnerability reports

### Describe the issue linked to the documentation

### Issues
- The project receives reports from huntr that are not useful.
- The reports from huntr are time consuming and use up limited maintainer resources.

### Discussion / Proposal
- Update our [SECURITY.md](http://security.md/) file to indicate how we are dealing with huntr reports
- Direct security reporters to provide more detailed information on security vulnerability including proof of concept (POC) and proof of impact (POI)
- Once POC and POI is established, can direct people to report issue via the GitHub Security Advisory: https://github.com/scikit-learn/scikit-learn/security/advisories/new
- Remove scikit-learn from the huntr bug bounty program


### Proposed text for huntr reports
Draft text for huntr submissions: 
>The scikit-learn project is not reviewing reports submitted to huntr. Please use our SECURITY.md to submit reports. For security reports, provide both a POC (proof of concept) and POI (proof of impact). If your report is deemed impactful, you can then report it to huntr to collect a bounty.

### References
- [Scientific Python SPEC](https://github.com/scientific-python/specs/pull/391/)
- [NumPy discussion on security](https://github.com/numpy/numpy/issues/29178)
- [Dask: comment from huntr person](https://github.com/dask/community/issues/415#issuecomment-2755046159)

### Suggest a potential alternative/fix

_No response_

COMMENT:
Marking as "Waste of time" makes the report public ...

In other words, "Waste of time" is one of the possible markers when you resolve, in the end it still makes the report public ...

Labels: Documentation, Needs Investigation
DOC Managing huntr security vulnerability reports

### Describe the issue linked to the documentation

### Issues
- The project receives reports from huntr that are not useful.
- The reports from huntr are time consuming and use up limited maintainer resources.

### Discussion / Proposal
- Update our [SECURITY.md](http://security.md/) file to indicate how we are dealing with huntr reports
- Direct security reporters to provide more detailed information on security vulnerability including proof of concept (POC) and proof of impact (POI)
- Once POC and POI is established, can direct people to report issue via the GitHub Security Advisory: https://github.com/scikit-learn/scikit-learn/security/advisories/new
- Remove scikit-learn from the huntr bug bounty program


### Proposed text for huntr reports
Draft text for huntr submissions: 
>The scikit-learn project is not reviewing reports submitted to huntr. Please use our SECURITY.md to submit reports. For security reports, provide both a POC (proof of concept) and POI (proof of impact). If your report is deemed impactful, you can then report it to huntr to collect a bounty.

### References
- [Scientific Python SPEC](https://github.com/scientific-python/specs/pull/391/)
- [NumPy discussion on security](https://github.com/numpy/numpy/issues/29178)
- [Dask: comment from huntr person](https://github.com/dask/community/issues/415#issuecomment-2755046159)

### Suggest a potential alternative/fix

_No response_

COMMENT:
> Marking as "Waste of time" makes the report public ...

Wonderful: a public waste of time.

Labels: Documentation, Needs Investigation
DOC Managing huntr security vulnerability reports

### Describe the issue linked to the documentation

### Issues
- The project receives reports from huntr that are not useful.
- The reports from huntr are time consuming and use up limited maintainer resources.

### Discussion / Proposal
- Update our [SECURITY.md](http://security.md/) file to indicate how we are dealing with huntr reports
- Direct security reporters to provide more detailed information on security vulnerability including proof of concept (POC) and proof of impact (POI)
- Once POC and POI is established, can direct people to report issue via the GitHub Security Advisory: https://github.com/scikit-learn/scikit-learn/security/advisories/new
- Remove scikit-learn from the huntr bug bounty program


### Proposed text for huntr reports
Draft text for huntr submissions: 
>The scikit-learn project is not reviewing reports submitted to huntr. Please use our SECURITY.md to submit reports. For security reports, provide both a POC (proof of concept) and POI (proof of impact). If your report is deemed impactful, you can then report it to huntr to collect a bounty.

### References
- [Scientific Python SPEC](https://github.com/scientific-python/specs/pull/391/)
- [NumPy discussion on security](https://github.com/numpy/numpy/issues/29178)
- [Dask: comment from huntr person](https://github.com/dask/community/issues/415#issuecomment-2755046159)

### Suggest a potential alternative/fix

_No response_

COMMENT:
Is there a way to edit the reports? Or does what the reporter wrote go live verbatim? If yes, we can edit the report to say "please use GHSA" and mark it as "waste of time".

Labels: Documentation, Needs Investigation
DOC Managing huntr security vulnerability reports

### Describe the issue linked to the documentation

### Issues
- The project receives reports from huntr that are not useful.
- The reports from huntr are time consuming and use up limited maintainer resources.

### Discussion / Proposal
- Update our [SECURITY.md](http://security.md/) file to indicate how we are dealing with huntr reports
- Direct security reporters to provide more detailed information on security vulnerability including proof of concept (POC) and proof of impact (POI)
- Once POC and POI is established, can direct people to report issue via the GitHub Security Advisory: https://github.com/scikit-learn/scikit-learn/security/advisories/new
- Remove scikit-learn from the huntr bug bounty program


### Proposed text for huntr reports
Draft text for huntr submissions: 
>The scikit-learn project is not reviewing reports submitted to huntr. Please use our SECURITY.md to submit reports. For security reports, provide both a POC (proof of concept) and POI (proof of impact). If your report is deemed impactful, you can then report it to huntr to collect a bounty.

### References
- [Scientific Python SPEC](https://github.com/scientific-python/specs/pull/391/)
- [NumPy discussion on security](https://github.com/numpy/numpy/issues/29178)
- [Dask: comment from huntr person](https://github.com/dask/community/issues/415#issuecomment-2755046159)

### Suggest a potential alternative/fix

_No response_

COMMENT:
> Is there a way to edit the reports?

I don't think so. Last time I tried, I was not able not even edit my own message after having posted it ...

Edit: here the [joblib report](https://huntr.com/bounties/2d0710cb-7e72-47d2-bc65-dd86cd5535fd) search for "edit my" it was 7 months ago.

Labels: Documentation, Needs Investigation
DOC Managing huntr security vulnerability reports

### Describe the issue linked to the documentation

### Issues
- The project receives reports from huntr that are not useful.
- The reports from huntr are time consuming and use up limited maintainer resources.

### Discussion / Proposal
- Update our [SECURITY.md](http://security.md/) file to indicate how we are dealing with huntr reports
- Direct security reporters to provide more detailed information on security vulnerability including proof of concept (POC) and proof of impact (POI)
- Once POC and POI is established, can direct people to report issue via the GitHub Security Advisory: https://github.com/scikit-learn/scikit-learn/security/advisories/new
- Remove scikit-learn from the huntr bug bounty program


### Proposed text for huntr reports
Draft text for huntr submissions: 
>The scikit-learn project is not reviewing reports submitted to huntr. Please use our SECURITY.md to submit reports. For security reports, provide both a POC (proof of concept) and POI (proof of impact). If your report is deemed impactful, you can then report it to huntr to collect a bounty.

### References
- [Scientific Python SPEC](https://github.com/scientific-python/specs/pull/391/)
- [NumPy discussion on security](https://github.com/numpy/numpy/issues/29178)
- [Dask: comment from huntr person](https://github.com/dask/community/issues/415#issuecomment-2755046159)

### Suggest a potential alternative/fix

_No response_

COMMENT:
FYI I sent an email to the Huntr person as mentioned in https://github.com/scikit-learn/scikit-learn/issues/31657#issuecomment-3132590377. Let's see what happens!

I was hoping someone would beat me to it but I caved in 😅. One of the reason although I am not 100% sure: I thought Huntr was only sending emails to people on the `security@scikit-learn.org` mailing list, but actually it may send emails to some/all maintainers even if they are not on the `security@scikit-learn.org` mailing list 😓. If that's the case for you, feel more than free to unsubscribe from these emails.

Labels: Documentation, Needs Investigation