How do I responsibly disclose security issues?

[daveqnet]

Hi Prebid team,

I need to report a potential security issue affecting some Prebid releases. I've already sent a message using the contact form at https://prebid.org/contact-us/, but I'm not sure if that will reach the right people.

I checked for security contact information but couldn't find any. Who should I contact for private security disclosure? I'd prefer not to discuss the details publicly until you've had a chance to review.

Thanks!

[patmmccann]

best way is via slack; thank you!

[DanielRuf]

npmjs also has a contact form for this: https://www.npmjs.com/package/prebid

The team behind npmjs / GitHub can also coordinate such cases.

Regarding the released malicious version, it's recommended to rotate affected secrets, enforce 2FA (even for npmjs releases) and so on.

[Saigredan]

Hey!

In advisory database (GHSA-4hjx-fhh8-vr6j) Prebid.js is marked as compromised for all versions ( >=0). As far as I know, only versions 10.9.1 and 10.9.2 were affected, and fixed in 10.10.0. Shouldn't that be noted?

[DanielRuf]

@Saigredan correct, you have to open an issue to report this, see also the note on the bottom right and the other related issues:

github/advisory-database#6103
github/advisory-database#6100
github/advisory-database#6099
github/advisory-database#6098
...

[Saigredan]

github/advisory-database#6122 opened issue

[Saigredan]

moved to: GHSA-jwq7-6j4r-2f92

[dlemstra]

It might be a good idea to add a Security.md file to your project and also offer another way than slack to contact the team about a security issue. Your website mentions Slack is only available for members and it would help in case someone wants to report a new security issue.

[DanielRuf]

Not sure where Slack is mentioned (probably only for technical support), but my first try would normally be https://prebid.org/contact-us/.