Willy, Am 15.01.20 um 21:28 schrieb Willy Tarreau: > OK for those publishing it, but anyone looking there for a contact ? I > mean, when someone cannot just "git log" or "git blame" in an opensource > project to figure the people who touched the same area recently, I doubt > they'll ever know about this :-/ And the ones above are mainly made to > report issues to the sites hosters/companies but not to their opensource > projects it seems.
If anything I'd add a SECURITY.md or a short blurb to the README of the project itself. That's where I would look when attempting to report an issue and it some integration with the GitHub UI: https://help.github.com/en/github/managing-security-vulnerabilities/adding-a-security-policy-to-your-repository Best regards Tim Düsterhus
