diaspora/diaspora — Issue #2678: There should be a procedure to disclose security issues
Author: pixelistik
Created: 2012-01-16 20:43:28+00:00
State: open

Despite being still in Alpha, Diaspora already has a large user base, that could get hurt by security issues. When Beta is reached, this will be even more the case.

The bug report procedures documented on the Wiki and elsewhere are all public trackers. However, sometimes it would be better to disclose a security bug privately to the core team first.

There should be some clear, prominently documented procedure (maybe a simple security@joindiaspora.com email address) that people can use for this.