Stream: zulip

Topic: #security cleanup

Philip Durbin 🚀 (Sep 21 2024 at 13:53):

We've seen an uptick in people reporting security vulnerabilities in the #security channel. It's not particularly surprising that people were posting there. The temptation was too great! :sweat_smile:

Philip Durbin 🚀 (Sep 21 2024 at 13:58):

Here's what I did to try to address the problem:

• Changed #security so only Admins can post. (In practice, for us, this means Owners.)
• Moved all messages out of #security to #community
• Posted a single message in #security about how to report vulnerabilities and read more about our security policy

My thought is that we will never post any more message to #security. The channel exists for the sole purpose of directing the community to our established places to talk about security.

Philip Durbin 🚀 (Sep 21 2024 at 13:59):

I'm open to other ideas, of course, but this seemed like the best way to stem the tide of security reports in Zulip.

Philip Durbin 🚀 (Sep 23 2024 at 13:38):

@Don Sizemore @Oliver Bertuch (and others) what do you think? Does #security look ok to you?

Don Sizemore (Sep 23 2024 at 14:05):

Security reports should not be publicly visible. Thank you for cleaning this up.

Last updated: Nov 01 2025 at 14:11 UTC