Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: the project should respond to messages to their security list in a timely manner

...

If your project handles many security reports, it can be helpful to introduce a private security@<project>.apache.org mailinglist. If such a list exists, security reports will be sent to this list instead of to the PMC. The list should contain enough PMC members to make sure the project can responsibly deal with any incoming security reportsmessages about security issues responsibly and timely. You can also add trusted committers to this list, if they for some reason cannot or don't want to join the PMC.

...