docs: switch security reporting to GitHub private vulnerability reporting#23559
Open
Vad1mo wants to merge 2 commits into
Open
docs: switch security reporting to GitHub private vulnerability reporting#23559Vad1mo wants to merge 2 commits into
Vad1mo wants to merge 2 commits into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #23559 +/- ##
==========================================
+ Coverage 66.36% 66.38% +0.01%
==========================================
Files 1073 1073
Lines 117716 117716
Branches 2965 2965
==========================================
+ Hits 78120 78142 +22
+ Misses 35292 35273 -19
+ Partials 4304 4301 -3
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Harbor’s security disclosure documentation and GitHub issue intake to route vulnerability reports through GitHub Private Vulnerability Reporting, aligning the repo’s public guidance with the advisory-based workflow.
Changes:
- Updates
SECURITY.mdto direct reporters to GitHub private vulnerability reporting and describe the advisory-driven embargo workflow. - Adds an issue chooser
contact_linksentry to route security reports away from public issues. - Adds a prominent warning to the bug report template to prevent public filing of vulnerabilities.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| SECURITY.md | Switches primary reporting channel to GitHub private vulnerability reporting and updates the disclosure workflow narrative. |
| .github/ISSUE_TEMPLATE/config.yml | Adds an issue chooser contact link for private vulnerability reporting. |
| .github/ISSUE_TEMPLATE/bug_report.md | Adds a top-of-template warning to redirect security reports to the private advisory form. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| **IMPORTANT: Do not file public issues on GitHub for security vulnerabilities** | ||
|
|
||
| To report a vulnerability or a security-related issue, please email the private address cncf-harbor-security@lists.cncf.io with the details of the vulnerability. The email will be fielded by the Harbor Security Team, which is made up of Harbor maintainers who have committer and release permissions. Emails will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. Do not report non-security-impacting bugs through this channel. Use [GitHub issues](https://github.com/goharbor/harbor/issues/new/choose) instead. | ||
| To report a vulnerability or a security-related issue, use [GitHub private vulnerability reporting](https://github.com/goharbor/harbor/security/advisories/new): open the [Security tab](https://github.com/goharbor/harbor/security) of the affected repository and click **Report a vulnerability**. The report is only visible to the Harbor Security Team, which is made up of Harbor maintainers who have committer and release permissions. Reports will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. Do not report non-security-impacting bugs through this channel. Use [GitHub issues](https://github.com/goharbor/harbor/issues/new/choose) instead. |
Comment on lines
49
to
50
| ## Mailing lists | ||
| - Use cncf-harbor-security@lists.cncf.io to report security concerns to the Harbor Security Team, who uses the list to privately discuss security issues and fixes prior to disclosure. | ||
| - Join cncf-harbor-distributors-announce@lists.cncf.io for early private information and vulnerability disclosure. Early disclosure may include mitigating steps and additional information on security patch releases. See below for information on how Harbor distributors or vendors can apply to join this list. |
|
|
||
| **⚠️ If this is a security vulnerability, do NOT file a public issue.** Report it privately via [GitHub private vulnerability reporting](https://github.com/goharbor/harbor/security/advisories/new). See [SECURITY.md](https://github.com/goharbor/harbor/blob/main/SECURITY.md) for the full disclosure policy. | ||
|
|
||
| If you are reporting a problem, please make sure the following information are provided: |
OrlinVasilev
approved these changes
Jul 15, 2026
…ting Replace the cncf-harbor-security mailing list with GitHub private vulnerability reporting as the intake channel for security reports, per goharbor/community#292. Private vulnerability reporting is enabled on the repository. - SECURITY.md: point reporters at the Security tab / Report a vulnerability form; describe the advisory-based triage, CVSS, in-band CVE request, and temporary private fork workflow; keep the mailing list only as a fallback for reporters without a GitHub account and for distributor list membership requests - Add issue template contact link routing vulnerability reports to the private advisory form - Add a security warning to the bug report template Signed-off-by: Vadim Bauer <vb@container-registry.com>
Address review feedback: drop the mailing-list fallback so there is a single reporting method, clarify that the reporter can see their own report, and fix template grammar. Signed-off-by: Vadim Bauer <vb@container-registry.com>
stonezdj
force-pushed
the
docs/github-private-vulnerability-reporting
branch
from
July 22, 2026 07:32
1c233be to
a88d675
Compare
stonezdj
enabled auto-merge (squash)
July 22, 2026 07:32
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
Comments suppressed due to low confidence (1)
SECURITY.md:14
- The PR says the mailing list remains a fallback for reporters without a GitHub account, but this section only states that an account is required and gives those reporters no reporting path. Please document the promised fallback here so accountless reporters are not blocked from private disclosure.
To report a vulnerability or a security-related issue, use [GitHub private vulnerability reporting](https://github.com/goharbor/harbor/security/advisories/new): open the [Security tab](https://github.com/goharbor/harbor/security) of the affected repository and click **Report a vulnerability**. The report is visible only to you and the Harbor Security Team, which is made up of Harbor maintainers who have committer and release permissions. Reports will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. Do not report non-security-impacting bugs through this channel. Use [GitHub issues](https://github.com/goharbor/harbor/issues/new/choose) instead. Note that filing a report requires a GitHub account.
| **IMPORTANT: Do not file public issues on GitHub for security vulnerabilities** | ||
|
|
||
| To report a vulnerability or a security-related issue, please email the private address cncf-harbor-security@lists.cncf.io with the details of the vulnerability. The email will be fielded by the Harbor Security Team, which is made up of Harbor maintainers who have committer and release permissions. Emails will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. Do not report non-security-impacting bugs through this channel. Use [GitHub issues](https://github.com/goharbor/harbor/issues/new/choose) instead. | ||
| To report a vulnerability or a security-related issue, use [GitHub private vulnerability reporting](https://github.com/goharbor/harbor/security/advisories/new): open the [Security tab](https://github.com/goharbor/harbor/security) of the affected repository and click **Report a vulnerability**. The report is visible only to you and the Harbor Security Team, which is made up of Harbor maintainers who have committer and release permissions. Reports will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. Do not report non-security-impacting bugs through this channel. Use [GitHub issues](https://github.com/goharbor/harbor/issues/new/choose) instead. Note that filing a report requires a GitHub account. |
| 6. The Security Team will work on fixing the vulnerability and perform internal testing before preparing to roll out the fix. | ||
| 7. The Security Team will provide early disclosure of the vulnerability by emailing the cncf-harbor-distributors-announce@lists.cncf.io mailing list. Distributors can initially plan for the vulnerability patch ahead of the fix, and later can test the fix and provide feedback to the Harbor team. See the section **Early Disclosure to Harbor Distributors List** for details about how to join this mailing list. | ||
| 4. If a vulnerability is acknowledged, the Security Team will accept the report as a draft security advisory, and the reporter is added as a collaborator on it. The Security Team will then work on a plan to communicate with the appropriate community, including identifying mitigating steps that affected users can take to protect themselves until the fix is rolled out. | ||
| 5. The Security Team will also assess the severity of the vulnerability with a [CVSS](https://www.first.org/cvss/specification-document) score, using the calculator built into the draft advisory. The Security Team makes the final call on the calculated CVSS; it is better to move quickly than making the CVSS perfect. A CVE will be requested from GitHub through the draft advisory; the CVE remains private until the advisory is published. |
stonezdj
disabled auto-merge
July 22, 2026 07:36
stonezdj
reviewed
Jul 22, 2026
| **IMPORTANT: Do not file public issues on GitHub for security vulnerabilities** | ||
|
|
||
| To report a vulnerability or a security-related issue, please email the private address cncf-harbor-security@lists.cncf.io with the details of the vulnerability. The email will be fielded by the Harbor Security Team, which is made up of Harbor maintainers who have committer and release permissions. Emails will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. Do not report non-security-impacting bugs through this channel. Use [GitHub issues](https://github.com/goharbor/harbor/issues/new/choose) instead. | ||
| To report a vulnerability or a security-related issue, use [GitHub private vulnerability reporting](https://github.com/goharbor/harbor/security/advisories/new): open the [Security tab](https://github.com/goharbor/harbor/security) of the affected repository and click **Report a vulnerability**. The report is visible only to you and the Harbor Security Team, which is made up of Harbor maintainers who have committer and release permissions. Reports will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. Do not report non-security-impacting bugs through this channel. Use [GitHub issues](https://github.com/goharbor/harbor/issues/new/choose) instead. Note that filing a report requires a GitHub account. |
Contributor
There was a problem hiding this comment.
Reports will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime.
Because of LLM is widedly used, there maybe more security issues than we can handled in 3 business days. it is better to changed to
Reports will be acknowledged in 3 business days. the Harbor Security Team need to investigate the issue and make follow-up decision in 2 weeks.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the intake-channel change from goharbor/community#292: replace the
cncf-harbor-security@lists.cncf.iomailing list with GitHub private vulnerability reporting as the channel for reporting security vulnerabilities. Private vulnerability reporting is already enabled on this repository.Changes
cncf-harbor-distributors-announce), the embargo policy, and disclosure timing are unchanged, per the proposal's non-goals.Related