@@ -35,16 +35,16 @@ includes a fix, documentation, an informational CVE or blog post.
35
35
36
36
<!-- ncu-team-sync.team(nodejs/security-triage) -->
37
37
38
- - [ @bnoordhuis ] ( https://github.com/bnoordhuis ) - Ben Noordhuis
39
- - [ @cjihrig ] ( https://github.com/cjihrig ) - Colin Ihrig
40
- - [ @indutny ] ( https://github.com/indutny ) - Fedor Indutny
41
- - [ @jasnell ] ( https://github.com/jasnell ) - James M Snell
42
- - [ @mcollina ] ( https://github.com/mcollina ) - Matteo Collina
43
- - [ @MylesBorins ] ( https://github.com/MylesBorins ) - Myles Borins
44
- - [ @ronag ] ( https://github.com/ronag ) - Robert Nagy
45
- - [ @shigeki ] ( https://github.com/shigeki ) - Shigeki Ohtsu
46
- - [ @vdeturckheim ] ( https://github.com/vdeturckheim ) - Vladimir de Turckheim
47
- - [ @watson ] ( https://github.com/watson ) - Thomas Watson
38
+ * [ @bnoordhuis ] ( https://github.com/bnoordhuis ) - Ben Noordhuis
39
+ * [ @cjihrig ] ( https://github.com/cjihrig ) - Colin Ihrig
40
+ * [ @indutny ] ( https://github.com/indutny ) - Fedor Indutny
41
+ * [ @jasnell ] ( https://github.com/jasnell ) - James M Snell
42
+ * [ @mcollina ] ( https://github.com/mcollina ) - Matteo Collina
43
+ * [ @MylesBorins ] ( https://github.com/MylesBorins ) - Myles Borins
44
+ * [ @ronag ] ( https://github.com/ronag ) - Robert Nagy
45
+ * [ @shigeki ] ( https://github.com/shigeki ) - Shigeki Ohtsu
46
+ * [ @vdeturckheim ] ( https://github.com/vdeturckheim ) - Vladimir de Turckheim
47
+ * [ @watson ] ( https://github.com/watson ) - Thomas Watson
48
48
49
49
<!-- ncu-team-sync end -->
50
50
@@ -54,12 +54,13 @@ The [TSC](https://github.com/nodejs/node#tsc-technical-steering-committee)
54
54
have access.
55
55
56
56
These non-TSC and TSC Emeriti also have access:
57
+
57
58
* [ bnoordhuis] ( https://github.com/bnoordhuis ) - ** Ben Noordhuis**
58
59
* [ indutny] ( https://github.com/indutny ) - ** Fedor Indutny**
59
60
* [ ronag] ( https://github.com/ronag ) - ** Robert Nagy**
60
61
* [ rvagg] ( https://github.com/rvagg ) - ** Rod Vagg**
61
62
* [ vdeturckheim] ( https://github.com/vdeturckheim ) - ** Vladimir de Turckheim**
62
- - [ @watson ] ( https://github.com/watson ) - ** Thomas Watson**
63
+ * [ @watson ] ( https://github.com/watson ) - ** Thomas Watson**
63
64
64
65
List is from the [ member page] ( https://hackerone.com/nodejs/team_members ) for
65
66
the Node.js program on HackerOne.
@@ -68,39 +69,39 @@ the Node.js program on HackerOne.
68
69
69
70
<!-- ncu-team-sync.team(nodejs-private/security) -->
70
71
71
- - [ @apapirovski ] ( https://github.com/apapirovski ) - Anatoli Papirovski
72
- - [ @BethGriggs ] ( https://github.com/BethGriggs ) - Bethany Nicolle Griggs
73
- - [ @bnoordhuis ] ( https://github.com/bnoordhuis ) - Ben Noordhuis
74
- - [ @BridgeAR ] ( https://github.com/BridgeAR ) - Ruben Bridgewater
75
- - [ @ChALkeR ] ( https://github.com/ChALkeR ) - Сковорода Никита Андреевич
76
- - [ @cjihrig ] ( https://github.com/cjihrig ) - Colin Ihrig
77
- - [ @codebytere ] ( https://github.com/codebytere ) - Shelley Vohr
78
- - [ @danbev ] ( https://github.com/danbev ) - Daniel Bevenius
79
- - [ @dougwilson ] ( https://github.com/dougwilson ) - Douglas Wilson
80
- - [ @evilpacket ] ( https://github.com/evilpacket ) - Adam Baldwin
81
- - [ @fhinkel ] ( https://github.com/fhinkel ) - F. Hinkelmann
82
- - [ @gabrielschulhof ] ( https://github.com/gabrielschulhof ) - Gabriel Schulhof
83
- - [ @gireeshpunathil ] ( https://github.com/gireeshpunathil ) - Gireesh Punathil
84
- - [ @indutny ] ( https://github.com/indutny ) - Fedor Indutny
85
- - [ @jasnell ] ( https://github.com/jasnell ) - James M Snell
86
- - [ @jbergstroem ] ( https://github.com/jbergstroem ) - Johan Bergström
87
- - [ @joaocgreis ] ( https://github.com/joaocgreis ) - João Reis
88
- - [ @joyeecheung ] ( https://github.com/joyeecheung ) - Joyee Cheung
89
- - [ @mcollina ] ( https://github.com/mcollina ) - Matteo Collina
90
- - [ @mhdawson ] ( https://github.com/mhdawson ) - Michael Dawson
91
- - [ @mmarchini ] ( https://github.com/mmarchini ) - mary marchini
92
- - [ @MylesBorins ] ( https://github.com/MylesBorins ) - Myles Borins
93
- - [ @richardlau ] ( https://github.com/richardlau ) - Richard Lau
94
- - [ @ronag ] ( https://github.com/ronag ) - Robert Nagy
95
- - [ @ruyadorno ] ( https://github.com/ruyadorno ) - Ruy Adorno
96
- - [ @rvagg ] ( https://github.com/rvagg ) - Rod Vagg
97
- - [ @saghul ] ( https://github.com/saghul ) - Saúl Ibarra Corretgé
98
- - [ @shigeki ] ( https://github.com/shigeki ) - Shigeki Ohtsu
99
- - [ @targos ] ( https://github.com/targos ) - Michaël Zasso
100
- - [ @tniessen ] ( https://github.com/tniessen ) - Tobias Nießen
101
- - [ @Trott ] ( https://github.com/Trott ) - Rich Trott
102
- - [ @vdeturckheim ] ( https://github.com/vdeturckheim ) - Vladimir de Turckheim
103
- - [ @watson ] ( https://github.com/watson ) - Thomas Watson
72
+ * [ @apapirovski ] ( https://github.com/apapirovski ) - Anatoli Papirovski
73
+ * [ @BethGriggs ] ( https://github.com/BethGriggs ) - Bethany Nicolle Griggs
74
+ * [ @bnoordhuis ] ( https://github.com/bnoordhuis ) - Ben Noordhuis
75
+ * [ @BridgeAR ] ( https://github.com/BridgeAR ) - Ruben Bridgewater
76
+ * [ @ChALkeR ] ( https://github.com/ChALkeR ) - Сковорода Никита Андреевич
77
+ * [ @cjihrig ] ( https://github.com/cjihrig ) - Colin Ihrig
78
+ * [ @codebytere ] ( https://github.com/codebytere ) - Shelley Vohr
79
+ * [ @danbev ] ( https://github.com/danbev ) - Daniel Bevenius
80
+ * [ @dougwilson ] ( https://github.com/dougwilson ) - Douglas Wilson
81
+ * [ @evilpacket ] ( https://github.com/evilpacket ) - Adam Baldwin
82
+ * [ @fhinkel ] ( https://github.com/fhinkel ) - F. Hinkelmann
83
+ * [ @gabrielschulhof ] ( https://github.com/gabrielschulhof ) - Gabriel Schulhof
84
+ * [ @gireeshpunathil ] ( https://github.com/gireeshpunathil ) - Gireesh Punathil
85
+ * [ @indutny ] ( https://github.com/indutny ) - Fedor Indutny
86
+ * [ @jasnell ] ( https://github.com/jasnell ) - James M Snell
87
+ * [ @jbergstroem ] ( https://github.com/jbergstroem ) - Johan Bergström
88
+ * [ @joaocgreis ] ( https://github.com/joaocgreis ) - João Reis
89
+ * [ @joyeecheung ] ( https://github.com/joyeecheung ) - Joyee Cheung
90
+ * [ @mcollina ] ( https://github.com/mcollina ) - Matteo Collina
91
+ * [ @mhdawson ] ( https://github.com/mhdawson ) - Michael Dawson
92
+ * [ @mmarchini ] ( https://github.com/mmarchini ) - mary marchini
93
+ * [ @MylesBorins ] ( https://github.com/MylesBorins ) - Myles Borins
94
+ * [ @richardlau ] ( https://github.com/richardlau ) - Richard Lau
95
+ * [ @ronag ] ( https://github.com/ronag ) - Robert Nagy
96
+ * [ @ruyadorno ] ( https://github.com/ruyadorno ) - Ruy Adorno
97
+ * [ @rvagg ] ( https://github.com/rvagg ) - Rod Vagg
98
+ * [ @saghul ] ( https://github.com/saghul ) - Saúl Ibarra Corretgé
99
+ * [ @shigeki ] ( https://github.com/shigeki ) - Shigeki Ohtsu
100
+ * [ @targos ] ( https://github.com/targos ) - Michaël Zasso
101
+ * [ @tniessen ] ( https://github.com/tniessen ) - Tobias Nießen
102
+ * [ @Trott ] ( https://github.com/Trott ) - Rich Trott
103
+ * [ @vdeturckheim ] ( https://github.com/vdeturckheim ) - Vladimir de Turckheim
104
+ * [ @watson ] ( https://github.com/watson ) - Thomas Watson
104
105
105
106
<!-- ncu-team-sync end -->
106
107
@@ -113,9 +114,9 @@ Report states are described in HackerOne [docs](https://docs.hackerone.com/progr
113
114
The expected workflow for issues reported to Node.js is:
114
115
115
116
1 . ` NEW ` : issue reported (initial state). Issues in this state are in the
116
- process of being analyzed with the intention to move them into either
117
- ` TRIAGED ` , ` NEEDS-MORE-INFO ` , or one of the "Closed" states
118
- (` NOT-APPLICABLE ` , ` INFORMATIVE ` , etc.). Has several sub-states:
117
+ process of being analyzed with the intention to move them into either
118
+ ` TRIAGED ` , ` NEEDS-MORE-INFO ` , or one of the "Closed" states
119
+ (` NOT-APPLICABLE ` , ` INFORMATIVE ` , etc.). Has several sub-states:
119
120
1 . ` H1 Triage ` : Issues start off assigned to the ` H1 Triage ` team. That team
120
121
does initial triage. They ask for a runnable reproduction, they run it,
121
122
and they verify whether it does in fact appear to demonstrate a
@@ -129,36 +130,36 @@ The expected workflow for issues reported to Node.js is:
129
130
When further progress on the issue is blocked on response from the reporter,
130
131
this is the state.
131
132
2 . ` TRIAGED ` : State for an issue when it is a non-duplicate and resolvable.
132
- Issues in this state are waiting for the Node.js team to take some action to
133
- resolve them. Typically, this would be publishing a Node.js release that
134
- resolves the issue, but it could also be publishing documentation, or making
135
- a configuration change to our infrastructure for a < https://nodejs.org >
136
- problem. The expected resolution should be described in a comment on the
137
- issue when it is moved to ` TRIAGED ` .
138
- - ...: There are no explicit states for an issue as it is in process of
133
+ Issues in this state are waiting for the Node.js team to take some action to
134
+ resolve them. Typically, this would be publishing a Node.js release that
135
+ resolves the issue, but it could also be publishing documentation, or making
136
+ a configuration change to our infrastructure for a < https://nodejs.org >
137
+ problem. The expected resolution should be described in a comment on the
138
+ issue when it is moved to ` TRIAGED ` .
139
+ * ...: There are no explicit states for an issue as it is in process of
139
140
getting resolved. Comments on the issue when someone is working on it are
140
141
useful, as is assignment of the issue to a person who agrees to be
141
142
responsible for following it through to resolution and disclosure.
142
- - Once a fix is ready for release, the issue should be assigned to the
143
+ * Once a fix is ready for release, the issue should be assigned to the
143
144
` Ready for release ` team, and a comment added indicating the relevant PRs that
144
145
need to be merged during the release process.
145
- 5 . ` RESOLVED ` : State for an issue that has had a fix published. Issues in this
146
- state should be disclosed.
147
- 6 . ...: Final states for issues that we will not fix:
148
- - ` NOT-APPLICABLE ` : We do not agree this a vulnerability. We can request
146
+ 3 . ` RESOLVED ` : State for an issue that has had a fix published. Issues in this
147
+ state should be disclosed.
148
+ 4 . ...: Final states for issues that we will not fix:
149
+ * ` NOT-APPLICABLE ` : We do not agree this a vulnerability. We can request
149
150
that the reporter close it to preserve their H1 "reputation points". If
150
151
it is an issue, though not a vulnerability, we can suggest that it be
151
152
reported to the Node.js issue tracker.
152
- - ` INFORMATIVE ` : This means we agree that the report contains useful
153
+ * ` INFORMATIVE ` : This means we agree that the report contains useful
153
154
information, but we don't intend to publish a fix. This might be because
154
155
it isn't possible, or because its in an unsupported API or version. We
155
156
can consider disclosing it if we think the information should be
156
157
publicized.
157
- - ` DUPLICATE ` : The report is a duplicate of an already reported issue. It
158
+ * ` DUPLICATE ` : The report is a duplicate of an already reported issue. It
158
159
should not need disclosure, because the original issue will be disclosed
159
160
after it is resolved.
160
- - ` SPAM ` : Self-explanatory (and rare).
161
- 7 . Disclosure: This not a HackerOne report state, but it is the final state
162
- from our perspective. Disclosure should be considered once an issue is
163
- closed. See the
164
- [ disclosure docs] ( https://docs.hackerone.com/programs/disclosure.html ) .
161
+ * ` SPAM ` : Self-explanatory (and rare).
162
+ 5 . Disclosure: This not a HackerOne report state, but it is the final state
163
+ from our perspective. Disclosure should be considered once an issue is
164
+ closed. See the
165
+ [ disclosure docs] ( https://docs.hackerone.com/programs/disclosure.html ) .
0 commit comments