From 84ee7199e7bde487252c662c787cc0c1bd5dc537 Mon Sep 17 00:00:00 2001 From: Jim Manico Date: Fri, 25 Sep 2026 19:48:17 -0700 Subject: [PATCH] State the bug bounty scope where reporters read it SECURITY.md is what GitHub shows a reporter, and it said how to report but not what is in scope. The ground rules said the sanitizer is the target and the project's infrastructure is out of bounds, but not that other OWASP repositories are, nor that public-by-design data such as commit author addresses is not a disclosure. A Bugcrowd submission filed the GitHub commits API of another OWASP repository as PII leakage against this engagement. Add a Scope section to SECURITY.md that names the target, lists what is out of scope, and says a report with no example input is closed as not applicable. Say the same in the ground rules' Out of Bounds section so the two stay in step. Co-Authored-By: Claude Fable 5.1 --- SECURITY.md | 16 ++++++++++++++++ docs/attack_review_ground_rules.md | 2 +- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index bf51c300..a5cd4d54 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,7 +8,23 @@ Only the latest version is supported with updates. | ---------- | ------------------ | | 20260924.2 | :white_check_mark: | +## Scope +The target is the sanitizer library as written: HTML input that the +sanitizer lets through and a browser then acts on, or input that makes the +sanitizer throw, hang, or consume inordinate resources. The +[attack review ground rules](docs/attack_review_ground_rules.md) list what +counts as a win. + +Out of scope: + +* The project's infrastructure: GitHub, the CI runners, and Bugcrowd. +* Other OWASP repositories, projects, and websites. +* Information that is public by design, such as author and committer + addresses in the commit history of a public git repository. + +A report needs an example input and what it does. A report with no input +is closed as not applicable. ## Reporting a Vulnerability diff --git a/docs/attack_review_ground_rules.md b/docs/attack_review_ground_rules.md index bc4cbe8a..71ce658d 100644 --- a/docs/attack_review_ground_rules.md +++ b/docs/attack_review_ground_rules.md @@ -31,7 +31,7 @@ If you wish to remain anonymous, say so in your report. ## Out of Bounds -The target is the sanitizer as written. Attacks on the project's infrastructure, such as GitHub, the CI runners, or Bugcrowd, are out of bounds. +The target is the sanitizer as written. Attacks on the project's infrastructure, such as GitHub, the CI runners, or Bugcrowd, are out of bounds. So are other OWASP repositories, projects, and websites, and information that is public by design, such as author and committer addresses in the commit history of a public git repository. A report with no example input is closed as not applicable. ## Questions