ppkarwasz opened a new pull request, #57844: URL: https://github.com/apache/spark/pull/57844
### What changes were proposed in this pull request? Follow-up to [SPARK-56998](https://issues.apache.org/jira/browse/SPARK-56998), which added `SECURITY.md`. **Reporting a vulnerability** - Point at the ASF Security Team address only, instead of `[email protected]`. Reports that are sent to `[email protected]` are already **delivered** to the PMC, so they bypass triage. - Restate the requirements for "one plain-text, unencrypted, email for each vulnerability", described in the message body rather than as an image, HTML, or PDF attachment. - State explicitly that a vulnerability must not be filed as a public issue or pull request, and must not be disclosed publicly before the project responds. **Threat model** Add a `Known non-findings` section declaring two categories of report out of scope: - **Unconfigured deployments.** Spark's security features are opt-in, and `docs/security.md` already says "none are secure by default". Reports whose premise is a deployment that ignores that guidance are out of scope. - **Spark executing the code it was given.** Submitting a job means asking a cluster to run user-supplied code on the driver and the executors, so an authorized submitter running arbitrary code is the product working as intended. The section closes by naming what remains in scope (execution by a party that never authenticated to a properly configured deployment, or escalation past controls Spark does provide), so the exclusions are not read as a blanket disclaimer. ### Why are the changes needed? Together with your `/security.html` page, `SECURITY.md` is one of the pages used by reporters to learn the security contact for the project. There is no sense triaging reports that were already delivered to the PMC: all the reports that arrived directly to `[email protected]` (including all the false positives) are for the PMC to handle, i.e. [step 3 of the handling process](https://www.apache.org/security/committers.html) is **skipped**. BTW: you need to remove `[email protected]` from the `/security.html` page of your website too. ### Does this PR introduce _any_ user-facing change? No. Documentation only. ### How was this patch tested? No tests. The change is a Markdown file with no build or site integration; it was proofread and the links were checked by hand. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Code (Claude Opus 5) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
