ppkarwasz opened a new pull request, #706: URL: https://github.com/apache/spark-website/pull/706
### What changes were proposed in this pull request? `security.md`, in the "Reporting security issues" section: - Point the reporting address at the ASF Security Team, [`[email protected]`](mailto:[email protected]?subject=%5BSECURITY%5D%20Spark), replacing `[email protected]`. - Ask reporters, before submitting, to confirm that the deployment under test is configured according to the [Spark Security](https://spark.apache.org/docs/latest/security.html) documentation, and to review the FAQ below. - Restate the ASF request for one plain-text, unencrypted email per vulnerability, described in the message body rather than as an attachment. - Give the "Frequently Asked Questions" heading an `id`, so the new text can link to it. The CVE headings on the same page already carry explicit ids. `site/security.html` is the regenerated Jekyll output for that page. ### Why are the changes needed? The page currently says: > To report a possible security vulnerability, please email `[email protected]`. This is a non-public list that will reach the Apache Security team, as well as the Spark PMC. That list was sunset at the beginning of 2026, and mail addressed to it is redirected to `[email protected]`. Reports are therefore not lost, but the page advertises an address that survives only by redirect, and it disagrees with [security.apache.org/projects](https://security.apache.org/projects/), which gives Spark's security contact as `[email protected]` while linking this page as Spark's advisories page. Naming the ASF Security Team directly removes the discrepancy. The two pre-report checks address the most common categories of invalid report the project receives: findings against deployments left in their insecure-by-default state, and findings that amount to "Spark executes the code it was given", which the FAQ on this page has documented as by design for some time. Pointing at both before the reporting address should cut down on reports that have to be rejected. A companion change to `SECURITY.md` in the main repository is at apache/spark#57844. ### Does this PR introduce _any_ user-facing change? Yes, to the website only: the reporting address on <https://spark.apache.org/security.html> changes, and the section gains the pre-report checks. ### How was this patch tested? `site/security.html` was regenerated with the pinned toolchain from `Gemfile.lock` (Jekyll 4.4.1, Rouge 3.26.0, Ruby 3.2) and the rendered page was checked in a browser. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Code (Claude Opus 5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
