- 🇺🇸United States cmlara
Adding some context to my post in #4 as the issues that caused my concern are now public, site owners have had time to install them.
At the time I was dealing with the Drupal Security Team allowing Drupal Core vulnerabilities to go without a fix for years after the initial reports were made. Specifically SA-CORE-2023-005 was an issue that was a concern. I had finished SA-CORE-2022-012 after an extended period of time to resolve (where the original concerns I raised were never actually fixed). Additionally I had negative experiences with the DST coordinating with Contrib maintainers who are non-responsive.
I agree security issues should initially be discussed in private, and that we do not do enough to facilitate this.
I am very concerned a policy threatening GIT access right could be abused to punish security consultants forcing us to choose between allowing security vulnerabilities to go unreported/unfixed or to loose our ability to maintain our own projects.