starred/Sonarr

Fork 0

mirror of https://github.com/Sonarr/Sonarr.git synced 2026-03-02 22:57:43 -05:00

Responsible disclosure policy #3951

New issue

Closed

opened 2026-02-20 06:00:00 -05:00 by deekerman · 5 comments

deekerman commented

2026-02-20 06:00:00 -05:00

Owner

Originally created by @JamieSlome on GitHub (Dec 7, 2021).

Hey there!

I belong to an open source security research community, and a member (@dwisiswant0) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

Originally created by @JamieSlome on GitHub (Dec 7, 2021). Hey there! I belong to an open source security research community, and a member (@dwisiswant0) has found an issue, but doesn’t know the best way to disclose it. If not a hassle, might you kindly add a `SECURITY.md` file with an email, or another contact method? GitHub [recommends](https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository) this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future. Thank you for your consideration, and I look forward to hearing from you! (cc @huntr-helper)

deekerman

2026-02-20 06:00:00 -05:00

closed this issue
added the
docs
label

deekerman commented

2026-02-20 06:00:02 -05:00

Author

Owner

@bakerboy448 commented on GitHub (Dec 7, 2021):

discord and getting in touch with Markus or Taloth is likely be the best bet as far as the disclosure route, for now at least.

Same concept - albeit different discords and a different dev team - for Lidarr/Radarr/Readarr/Prowlarr for future reference.

@bakerboy448 commented on GitHub (Dec 7, 2021): [discord](https://discord.gg/Ex7FmFK) and getting in touch with Markus or Taloth is likely be the best bet as far as the disclosure route, for now at least. Same concept - albeit different discords and a different dev team - for Lidarr/Radarr/Readarr/Prowlarr for future reference.

deekerman commented

2026-02-20 06:00:02 -05:00

Author

Owner

@JamieSlome commented on GitHub (Dec 8, 2021):

@bakerboy448 - thanks for the support here!

Just for reference the private report can be found here:

https://huntr.dev/bounties/c8e90d5b-c1df-449b-9a5e-b9a5a6189879/

It is only accessible to maintainers with write access to this repo 🤝

@JamieSlome commented on GitHub (Dec 8, 2021): @bakerboy448 - thanks for the support here! Just for reference the private report can be found here: https://huntr.dev/bounties/c8e90d5b-c1df-449b-9a5e-b9a5a6189879/ It is only accessible to maintainers with write access to this repo 🤝

deekerman commented

2026-02-20 06:00:02 -05:00

Author

Owner

@Taloth commented on GitHub (Dec 8, 2021):

Nice catch there, we should be able to fix it. Also thx for the SECURITY.md suggestion, most ppl can find us one way or the other, but having it explicitly in an .md file is a good idea.

@Taloth commented on GitHub (Dec 8, 2021): Nice catch there, we should be able to fix it. Also thx for the SECURITY.md suggestion, most ppl can find us one way or the other, but having it explicitly in an .md file is a good idea.

deekerman commented

2026-02-20 06:00:02 -05:00

Author

Owner

@JamieSlome commented on GitHub (Dec 9, 2021):

@Taloth - great, thanks for the confirmation!

If you think the report is valid, you can mark it on the report page, and the researcher will be awarded their bounty for their research.

Also, you can bag a bounty for fixing it too! 🤗

@JamieSlome commented on GitHub (Dec 9, 2021): @Taloth - great, thanks for the confirmation! If you think the report is valid, you can mark it on the report page, and the researcher will be awarded their bounty for their research. Also, you can bag a bounty for fixing it too! 🤗

deekerman commented

2026-02-20 06:00:02 -05:00

Author

Owner

@dwisiswant0 commented on GitHub (Nov 12, 2022):

Any updates on this, @bakerboy448 & @Taloth?

@dwisiswant0 commented on GitHub (Nov 12, 2022): Any updates on this, @bakerboy448 & @Taloth?

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/Sonarr#3951

No description provided.

Rows
Columns