document ongoing security and practices #3215#9241
Conversation
|
I spoke to @pdurbin about adding a SECURITY.md, and I wanted to mention that when a github repo uses this file properly it will add a new choice to the github issue type choices. The current Dataverse issue template looks like this...
One this PR is merged with the SECURITY.md file, you will see a new / 3rd choice to the issue type list that says... "...
Which I have found very useful to prevent someone from accidentally creating a security issue in a very public way. Here is how I used a SECURITY.md file to improve the opensource Islandora software's github issue type choices... |
The email is public in a couple places... - https://iqss.github.io/dataverse-installations/data/data.json - spreadsheet: https://docs.google.com/spreadsheets/d/1bfsw7gnHlHerLXuk7YprUT68liHfcaMxs1rFciA-mEo/edit?usp=sharing ... and while it's true that it's not currently displayed on the map, we might someday and I don't want to give the impression that we never will. It's public data. On a related note, we mention the contact email and spreadsheet here: - IQSS/dataverse#9241
4 participants
What this PR does / why we need it:
Which issue(s) this PR closes:
Special notes for your reviewer:
Here's a good entry point: https://dataverse-guide--9241.org.readthedocs.build/en/9241/installation/config.html#ongoing-security
Note that I added SECURITY.md: https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository
It's expected that the links in that SECURITY.md file won't work until we make a release (when the new content is in place under "latest").
Suggestions on how to test this:
Sanity check on the content. Please see entry point above.
Does this PR introduce a user interface change? If mockups are available, please link/include them here:
No.
Is there a release notes update needed for this change?:
No. I'm happy to add one.
Additional documentation:
This PR is only documentation.