You no longer accept security reports via email

[bagder]

Your page at https://github.com/NuGet/NuGetGallery/security says you do, but your auto-responder says you don't. Perhaps update the docs?

[bagder]

Additionally: when using the "portal" on microsoft.com that is now required, there is no nuget option to report against.

[blowdart]

@bagder Hi Daniel,

I've had the security.md file updated (when MSRC updated the process the bot that writes the security.md didn't get updated, so I'm trying to track down the owner).

In the portal itself MSRC lists the most "popular" reporting areas, and nuget server is not frequent enough in the products reported to be listed in the drop down, but of course you can manually specify the product and let MSRC figure out how to route it.

For your specific issue, which I had a few people ask about, that's much more suited to nuget's package reporting mechanism, rather than MSRC.

Regardless, if you feel you're blocked, or any of those mechanisms aren't given you feedback/progress.

Barry Dorrans,
.NET Security PM,
barry.dorrans@microsoft.com