| 1 | # Security Policies and Procedures
|
| 2 |
|
| 3 | ## Reporting a Bug
|
| 4 |
|
| 5 | The `finalhandler` team and community take all security bugs seriously. Thank
|
| 6 | you for improving the security of Express. We appreciate your efforts and
|
| 7 | responsible disclosure and will make every effort to acknowledge your
|
| 8 | contributions.
|
| 9 |
|
| 10 | Report security bugs by emailing the current owner(s) of `finalhandler`. This
|
| 11 | information can be found in the npm registry using the command
|
| 12 | `npm owner ls finalhandler`.
|
| 13 | If unsure or unable to get the information from the above, open an issue
|
| 14 | in the [project issue tracker](https://github.com/pillarjs/finalhandler/issues)
|
| 15 | asking for the current contact information.
|
| 16 |
|
| 17 | To ensure the timely response to your report, please ensure that the entirety
|
| 18 | of the report is contained within the email body and not solely behind a web
|
| 19 | link or an attachment.
|
| 20 |
|
| 21 | At least one owner will acknowledge your email within 48 hours, and will send a
|
| 22 | more detailed response within 48 hours indicating the next steps in handling
|
| 23 | your report. After the initial reply to your report, the owners will
|
| 24 | endeavor to keep you informed of the progress towards a fix and full
|
| 25 | announcement, and may ask for additional information or guidance.
|