Skip to content

Commit d177739

Browse files
krutonkruton
committed
chore: security issue reporting and other templates
Add instructions for how security vulnerabilities may be reported. Also add other issue templates so reports can be more organized and reporters know what information is needed in a report.
1 parent cc309c0 commit d177739

6 files changed

Lines changed: 213 additions & 0 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug-report.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Bug report
2+
description: Report a reproducible problem with the SSH library.
3+
title: "Bug: "
4+
labels: [bug]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: |
9+
Thanks for reporting a problem. Please include enough detail for maintainers to reproduce or reason about the issue.
10+
- type: textarea
11+
id: summary
12+
attributes:
13+
label: Summary
14+
description: What went wrong?
15+
validations:
16+
required: true
17+
- type: textarea
18+
id: reproduce
19+
attributes:
20+
label: Steps to reproduce
21+
description: Include a minimal code sample or command sequence when possible.
22+
placeholder: |
23+
1. Configure client with ...
24+
2. Connect to ...
25+
3. Observe ...
26+
validations:
27+
required: true
28+
- type: textarea
29+
id: expected
30+
attributes:
31+
label: Expected behavior
32+
description: What did you expect to happen?
33+
validations:
34+
required: true
35+
- type: textarea
36+
id: actual
37+
attributes:
38+
label: Actual behavior
39+
description: What happened instead? Include stack traces or logs if available.
40+
render: text
41+
validations:
42+
required: true
43+
- type: input
44+
id: version
45+
attributes:
46+
label: Library version
47+
placeholder: "0.2.2-SNAPSHOT"
48+
validations:
49+
required: true
50+
- type: input
51+
id: runtime
52+
attributes:
53+
label: Runtime
54+
description: Kotlin/JDK/Android version, if relevant.
55+
placeholder: "Kotlin 2.3.21, JDK 21"
56+
validations:
57+
required: false
58+
- type: textarea
59+
id: context
60+
attributes:
61+
label: Additional context
62+
description: Server implementation, algorithms, platform, or anything else useful.
63+
validations:
64+
required: false

‎.github/ISSUE_TEMPLATE/compatibility-report.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: Compatibility report
2+
description: Report interoperability with a specific SSH server, algorithm, or client workflow.
3+
title: "Compatibility: "
4+
labels: [compatibility]
5+
body:
6+
- type: input
7+
id: server
8+
attributes:
9+
label: SSH server
10+
description: Server implementation and version.
11+
placeholder: "OpenSSH_9.9p2"
12+
validations:
13+
required: true
14+
- type: input
15+
id: library-version
16+
attributes:
17+
label: Library version
18+
placeholder: "0.2.2-SNAPSHOT"
19+
validations:
20+
required: true
21+
- type: dropdown
22+
id: area
23+
attributes:
24+
label: Area
25+
options:
26+
- Connection setup
27+
- Key exchange
28+
- Host key verification
29+
- Authentication
30+
- Shell/session channel
31+
- SFTP
32+
- Port forwarding
33+
- Agent forwarding
34+
- Other
35+
validations:
36+
required: true
37+
- type: textarea
38+
id: algorithms
39+
attributes:
40+
label: Algorithms and configuration
41+
description: Include negotiated algorithms, client config, auth methods, or server config if known.
42+
render: text
43+
validations:
44+
required: false
45+
- type: textarea
46+
id: behavior
47+
attributes:
48+
label: Observed behavior
49+
description: What works or fails? Include logs or packet-level details if available.
50+
render: text
51+
validations:
52+
required: true
53+
- type: textarea
54+
id: expected
55+
attributes:
56+
label: Expected behavior
57+
description: What did you expect based on other clients, server docs, or protocol references?
58+
validations:
59+
required: false

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
blank_issues_enabled: true
2+
contact_links:
3+
- name: Security vulnerability
4+
url: https://github.com/connectbot/cbssh/security/advisories/new
5+
about: Please report vulnerabilities privately.

‎.github/ISSUE_TEMPLATE/feature-request.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Feature request
2+
description: Suggest a new capability or API improvement.
3+
title: "Feature: "
4+
labels: [enhancement]
5+
body:
6+
- type: textarea
7+
id: problem
8+
attributes:
9+
label: Problem
10+
description: What are you trying to do, and what is missing today?
11+
validations:
12+
required: true
13+
- type: textarea
14+
id: proposal
15+
attributes:
16+
label: Proposed solution
17+
description: Describe the API, behavior, algorithm, or workflow you would like.
18+
validations:
19+
required: true
20+
- type: textarea
21+
id: alternatives
22+
attributes:
23+
label: Alternatives considered
24+
description: Workarounds, other libraries, or different designs you considered.
25+
validations:
26+
required: false
27+
- type: textarea
28+
id: context
29+
attributes:
30+
label: Additional context
31+
description: Relevant RFCs, OpenSSH behavior, server compatibility, or examples.
32+
validations:
33+
required: false

‎.github/ISSUE_TEMPLATE/security.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
name: Security report
3+
about: Report a vulnerability or sensitive security issue.
4+
title: "Security: "
5+
labels: security
6+
---
7+
8+
Please do not open a public issue for vulnerabilities or sensitive security reports.
9+
10+
Use GitHub's private vulnerability reporting for this repository:
11+
12+
https://github.com/connectbot/cbssh/security/advisories/new
13+
14+
Contact the maintainers privately if private reporting is unavailable.

‎SECURITY.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Security Policy
2+
3+
## Reporting a Vulnerability
4+
5+
Please do not report security vulnerabilities in public GitHub issues.
6+
7+
Use GitHub's private vulnerability reporting for this repository:
8+
9+
https://github.com/connectbot/cbssh/security/advisories/new
10+
11+
If private vulnerability reporting is unavailable, contact the maintainers privately before publishing details.
12+
13+
## What to Include
14+
15+
When possible, include:
16+
17+
- The affected library version or commit.
18+
- A clear description of the vulnerability and impact.
19+
- Steps to reproduce, proof-of-concept code, or relevant logs.
20+
- Any known affected SSH servers, algorithms, authentication methods, or protocol messages.
21+
- Whether the issue is already public or has been reported elsewhere.
22+
23+
Please avoid including secrets, private keys, production credentials, or sensitive host details in reports.
24+
25+
## Supported Versions
26+
27+
Security fixes are generally provided for:
28+
29+
- The current development line on `main`.
30+
- Active maintenance branches named `release/<major.minor>`.
31+
32+
Older versions may receive fixes when the impact is severe and a maintenance branch exists or can be reasonably created.
33+
34+
## Disclosure Process
35+
36+
Maintainers will review private reports and coordinate a fix before public disclosure when appropriate. Depending on severity and complexity, the fix may be released from `main`, an active `release/<major.minor>` branch, or both.
37+
38+
Public advisories, release notes, and CVE requests will be handled after a fix is available or a coordinated disclosure date is reached.

0 commit comments

Comments
 (0)