Coordinated vulnerability disclosureGitLab: Manufar Bayyanawa Cikin Alhaki
- Tuntuɓa: security@gitlab.com
- Shafin yanar gizo: https://about.gitlab.com/disclosure/
- An tabbatar: 2017-09-21
Da fatan za a aika imel zuwa security@gitlab.com don bayar da rahoton kowane rashin tsaro. Za mu tabbatar da karɓar rahotonka na rashin tsaro washegari na aiki kuma za mu yi ƙoƙarin aiko maka da sabuntawa akai-akai game da ci gabanmu. Idan kana son sanin halin da bayyanawarka take ciki, ka ji daɗin sake aiko mana da imel. Idan kana so ka ɓoye imel ɗin bayyanawarka, da fatan za ka aiko mana da imel don neman maɓallin PGP ɗinmu.
A madadin haka, kana iya aiko mana da rahotonka ta HackerOne.
Da fatan za ka guji neman diyya saboda bayar da rahoton rashin tsaro. Idan kana so, za mu yaba maka a bainar jama'a saboda bayyanawarka cikin alhaki. Muna kuma ƙoƙarin bayyana batun asiri ga jama'a bayan an sanar da rashin tsaron, don misali duba batun fasalin yin kama da wani. HackerOne ma yana bayyana rahotannin kurakurai ga jama'a bayan kwanaki 30 idan babu ɓangaren da ya ƙi, don misali duba rahoton XSS mai dawwama a shafin aikin jama'a.
Ba a yarda ka nemi raunin tsaro a GitLab.com kansa ba. GitLab manhaja ce ta buɗaɗɗen tushe, kana iya shigar da kwafi da kanka ka yi gwaji a kai. Kana iya zazzage CE, EE, ko GitLab Development Kit. Idan kana son yin gwaji ba tare da kafa GitLab da kanka ba, da fatan za ka tuntuɓe mu don shirya samun damar zuwa sabar gwaji.
Kana iya samun ƙarin bayani kan yadda muke tafiyar da fitowar tsaro a nan.
A shafinmu na yanar gizo kana iya samun ƙarin bayani game da samuwa da tsaron GitLab.com. Ana iya ganin batutuwan tsaro waɗanda ba raunin tsaro ba a na'urar bin diddigin batutuwanmu ta jama'a.
Batutuwan asiri
Idan aka gano rashin tsaro, muna ƙirƙirar batun asiri don bin diddiginsa a cikin gida. Ana tura gyare-gyaren tsaro zuwa dev.gitlab.org, wanda ba a iya shiga a bainar jama'a, kuma a haɗa su cikin reshen security. Bai kamata su bayyana a GitLab.com ba sai an sanar da fitowar tsaro kuma an samu kunshin da aka sabunta.
Ana iya samun cikakkun bayanai a cikin tsarin fitowa mai muhimmanci namu.