This is why you should have a page describing your security reporting process. > (1) Have a security contact, (2) publish a GPG key and accept GPG mail, (3) re

This is why you should have a page describing your security reporting process. > (1) Have a security contact, (2) publish a GPG key and accept GPG mail, (3) respond promptly with a "security flaw ID". https://news.ycombinator.com/item?id=640367 https://news.ycombinator.com/item?id=640367