We should consider adding a SECURITY.md document to the Koha git repository to give people insight into how to report security issues for Koha. https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository
Created attachment 184701 [details] [review] Bug 40527: Initial draft of SECURITY.md This patch includes an initial draft of a proposed SECURITY.md guideline for reporting security bugs to Koha.
Created attachment 186183 [details] [review] Bug 40527: Initial draft of SECURITY.md This patch includes an initial draft of a proposed SECURITY.md guideline for reporting security bugs to Koha. Signed-off-by: Ludovic Julien <ludovic.julien@inLibro.com>
This is a great addition! Having a clear and well-documented SECURITY.md makes it easier for community members to report vulnerabilities responsibly and helps ensure timely responses. I especially appreciate the clear step-by-step instructions and the reminder about keeping private information out of summaries. One possible improvement could be to explicitly list the expected response time range (even approximate), so reporters know what to expect. Overall, this is a very useful and important patch for improving Koha's security posture.
(In reply to Ludovic from comment #3) > This is a great addition! Thanks, Ludovic! > One possible improvement could be to explicitly list the expected response > time range (even approximate), so reporters know what to expect. It's a good suggestion. I did think about that, but I couldn't come up with a good answer. The best I could do was "as quickly as possible". Personally, I try to respond as soon as I see one has been raised, which is usually within 24-72 hours I think, but sometimes I'm not available (whether it's holiday, sickness, or other work commitments) or maybe I don't see it due to an email glitch. Maybe that's something we can discuss further in the community.
Created attachment 186993 [details] [review] Bug 40527: Initial draft of SECURITY.md This patch includes an initial draft of a proposed SECURITY.md guideline for reporting security bugs to Koha. Signed-off-by: Ludovic Julien <ludovic.julien@inLibro.com> Signed-off-by: Lisette Scheer <lisette@bywatersolutions.com>
I think that would be a good community discussion. Maybe the next General meeting?
(In reply to Lisette Scheer from comment #6) > I think that would be a good community discussion. Maybe the next General > meeting? I can never make the meetings but wouldn't hurt
Nice work everyone! Pushed to main for 25.11
kohadev-koha@kohadevbox:koha(main)$ prove -v /kohadevbox/koha/t/Makefile.t /kohadevbox/koha/t/Makefile.t .. 1..3 ok 1 - We should test something not ok 2 - All directories should be mapped: SECURITY.md # Failed test 'All directories should be mapped: SECURITY.md' # at /kohadevbox/koha/t/Makefile.t line 53. # got: '1' # expected: '0' ok 3 - no warnings # Looks like you failed 1 test of 3. Dubious, test returned 1 (wstat 256, 0x100) Failed 1/3 subtests
Created attachment 187710 [details] [review] Bug 40527: Add SECURITY.md to ignored list in MakeFile.t
follow-up pushed to main