From 5c5794d27ba8fd71b33ab1b893069531d8f08a49 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lo=C3=AFc=20Hoguin?= Date: Wed, 27 Feb 2013 18:25:45 +0100 Subject: Add more details on how to report bugs and vulnerabilities --- CONTRIBUTING.md | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) (limited to 'CONTRIBUTING.md') diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index e6ef8df..9e2fa32 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -20,12 +20,26 @@ repository `upstream` refers to the official repository for this project. Following this document will ensure prompt merging of your work in the `master` branch of the project. -Planning --------- +Reporting bugs +-------------- + +Upon identifying a bug or a DoS vulnerability, you SHOULD submit a ticket, +regardless of your plans for fixing it. If you plan to fix the bug, you +SHOULD discuss your plans to avoid having your work rejected. + +Upon identifying a security vulnerability in Erlang/OTP that leaves Cowboy +vulnerable to attack, you SHOULD consult privately with the Erlang/OTP team +to get the issue resolved. + +Upon identifying a security vulnerability in Cowboy's `cowboy_static` module, +you SHOULD submit a ticket, regardless of your plans for fixing it. Please +ensure that all necessary details to reproduce are listed. You then SHOULD +inform users on the mailing list about the issue, advising that they use +another means for sending static files until the issue is resolved. -Upon identifying a bug, you SHOULD submit a ticket, regardless of your -plans for fixing it. If you plan to fix the bug, you SHOULD discuss your -plans to avoid having your work rejected. +Upon identifying a security vulnerability in any other part of Cowboy, you +SHOULD contact us directly by email. Please ensure that all necessary details +to reproduce are listed. Before implementing a new feature, you SHOULD submit a ticket for discussion on your plans. The feature might have been rejected already, or the -- cgit v1.2.3