Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-10-25 10:35:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3178 from testssl/drwetter-patch-1

Browse Source 
revise phrases
This commit is contained in:
Dirk Wetter
2026-10-16 12:05:44 +02:00
committed by GitHub
parent 7ad4a6e2fe 7d2cff473c
commit e59d37a16b
1 changed files with 7 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+6 -9
View File
@@ -4,19 +4,16 @@
This project takes security seriously —this is meant literally —not like some companies claim after a breach or other security incident. This project takes security seriously —this is meant literally —not like some companies claim after a breach or other security incident.
The attack surface of testssl.sh is quite small and thus there should not be any serious blunders. We followed recommended security practises, e.g. like validate inputs and a lot more. The attack surface of testssl.sh is quite small and thus there should not be any serious blunders. We followed recommended security practices, e.g. validate inputs and more.
However this project was made by humans and despite our dedication there could be still security bugs. If you find one and the impact is not low, please use [Responsible However this project was made by humans and despite our dedication and diligence there could be still security bugs. If you find one and the impact is not low, please use [Responsible
Disclosure](https://en.wikipedia.org/wiki/Full_disclosure_(computer_security)#Coordinated_vulnerability_disclosure), see Disclosure](https://en.wikipedia.org/wiki/Full_disclosure_(computer_security)#Coordinated_vulnerability_disclosure), see [github docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/how-tos/report-and-fix-vulnerabilities/report-privately) and report them *privately* . If you happen to have a PoC, it will be much appreciated but it is not mandatory. Using [Full Disclosure](https://en.wikipedia.org/wiki/Full_disclosure_(computer_security)#Full_disclosure) might be a problem everywhere where testssl.sh is being used -- just for for CLI users, maintainers of CI/CD or monitoring environment or for people using testssl.sh as a scanner on their website.
[github docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/how-tos/report-and-fix-vulnerabilities/report-privately) and report them *privately* . If you happen
to have a PoC, it will be much appreciated but it is not mandatory. Using [Full Disclosure](https://en.wikipedia.org/wiki/Full_disclosure_(computer_security)#Full_disclosure) might be a problem for the people setting up a website using testssl.sh as a scanner or users.
Also keep in mind that the maintainers here have a professional attitude but this project, it is a spare time project.
### How do I do that? Also keep in mind that the maintainers here have a professional attitude but this project is volunteer work.
"Create new Issue" --> "Report a security vulnerability" . Then on the LHS you should see "Advisory" which you need to fill out. That stays private until we fixed your point or disregard it. ### How do I file a problem?
The UI is not very intuitive, thus if that doesn't work file a public issue that **this doesn't work**. "Create new Issue" --> "Report a security vulnerability" . Then on the LHS you should see "Advisory" which you need to fill out. That stays private until we fixed your point or, if your point has no impact, disregard it.
## Supported Versions ## Supported Versions