security reports? about oauth2-proxy HOT 13 CLOSED

There are no outstanding issues for security here. We are just using this issue to track the fact that we haven't documented how to report security issues.

Please use the latest releases to ensure you have up to date security patches

from oauth2-proxy.

This needs fixing and I am currently trying to work out how I want to handle this, I need to speak to our internal support team who currently handle most security issues for Pusher owned projects.

For now, could you please email me directly joel[at]pusher.com and I will look into the issue you have found.

from oauth2-proxy.

email sent :)

from oauth2-proxy.

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

from oauth2-proxy.

We still need to work out how security reports should be handled. As a note, if anyone finds this, please do not email my pusher address, I no longer work for Pusher and I will not receive it

from oauth2-proxy.

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

from oauth2-proxy.

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

from oauth2-proxy.

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

from oauth2-proxy.

@JoelSpeed @jtnord The security issue discussed here is not very clear. Is this still relevant? If yes, can you share more details for the same.

from oauth2-proxy.

this is still valid. there are no details on how to report security issues for this repo.

from oauth2-proxy.

Agreed. I or one of the other maintainers needs to find some time to create a SECURITY.md doc that explains what users should do if they do find any vulnerabilities and what our responsibilities are in these cases

from oauth2-proxy.

@jtnord @JoelSpeed Can you share how severe is the issue ? and What is the plan to fix this or Is there a patched version available ?

from oauth2-proxy.

This issue has been inactive for 60 days. If the issue is still relevant please comment to re-activate the issue. If no action is taken within 7 days, the issue will be marked closed.

from oauth2-proxy.