Security Playbooks – for Security WG members
- 1 Identify the owner of a repo
- 2 Onboard or offboard a working group member
- 3 Triage security@openedx.org emails
- 3.1 Reply as security@openedx.com
- 3.2 Assign emails to responders
- 3.3 Follow up
- 3.4 Close out
- 3.5 What to say
- 3.6 What to do
- 4 Forward a report to an operator or Axim
- 5 Respond to a security disclosure
- 6 Give security advice
- 7 Process suggestions for security improvements
- 8 Map a Name to a Github Username
Identify the owner of a repo
Check the
catalog-info.yaml
file.Search for
CODEOWNER
files in the repo.Ask someone from edx.org/2U to consult the 2U Ownership Spreadsheet.
Ask the PR Triage CCs for help routing to the correct owners.
Onboard or offboard a working group member
Add/remove in:
Add in (no removal necessary):
Triage security@openedx.org emails
When you’re on-call, you must reply to emails sent to security@openedx.org.
Reply as security@openedx.com
You should receive all emails sent to security@openedx.org in your work email.
Use the Google Groups web interface to reply as
Always change the “From:” field to security@openedx.org every time.
Assign emails to responders
Assign yourself to emails:
Received while you’re on-call
That you’re taking care of
In Google Groups, click on a message, then click on the “Assign to someone” button:
Follow up
Please follow up periodically to all emails assigned to you. Why:
Remind the reporter you need more information.
Reassure the reporter we are looking at the issue.
If you need to, handoff the email to another working group member. Don’t forget to re-assign it to them.
Close out
If the email requires no further follow up, use one of these buttons to close out a message:
Complete: You did work on the message, even if it was only investigation.
Duplicate: The message is entirely covered by another message.
Google Groups will ask you for the URL of original message. Fill it in.
No Action Needed: The message is frivolous, spam, or frivolous spam.
What to say
Our tone: direct, professional, but kind.
Tip: Hover over the right end of the response block to see a “Copy as text” button:
See https://openedx.atlassian.net/wiki/spaces/COMM/pages/3624140816/Security+Working+Group+Private#Common-Issues & add to them!
Acknowledge the email quickly:
Thank you for your email. We will investigate.
Common inquiries & template responses:
Duplicates:
Thank you for your report. This is a duplicate of an earlier report that we are reviewing.
No update yet:
Hello, We are continuing to investigate this report and will reach out to you when we have reached a resolution. Thank you.
Need proof of concept:
Hello, Would you be able to provide a proof of concept for the vulnerability? Thank you.
Confirm correct destination:
Hello, Thank you for reaching out. This e-mail address is the correct place to report any security issues you may have found. The Open edX project does not offer bug bounties for security vulnerability disclosures. See: https://github.com/openedx/edx-platform/security/policy#bug-bounty Thank you.
Bug bounty:
The Open edX project does not offer bug bounties for security vulnerability disclosures. See: https://github.com/openedx/edx-platform/security/policy#bug-bounty
Inapplicable reports/inquires
Intentionally open source:
Thank you for this report. Open edX is an open-source platform; many of our features are developed in the open and collaboratively with community developers. If you would be interested in contributing, you can learn more at https://open.edx.org/community/
Close out the email thread.
Forwarded to an operator or Axim:
Thank you for your email. We have determined your report pertains to a specific Open edX operator and have forwarded your report to them. The operator will reach out to you if any further information is required.
Re-send this email if the reporter continues to inquire about the operator’s contact information.
See Forward a report to an operator or Axim, below.
Not a security issue:
Thank you for the disclosure. We have investigated this and do not believe it is a security issue that needs to be addressed at this time.
Verified vulnerability:
Hello, Thank you for your patience. We are resolving the security vulnerability reported by your disclosure. The Open edX Project does not offer monetary bug bounties for security disclosures. Thank you again for your disclosure.
What to do
under construction
Forward a report to an operator or Axim
If a report applies only to a particular operator or to Axim:
Find the operator’s contact information at https://openedx.atlassian.net/wiki/spaces/COMM/pages/3624140816/Security+Working+Group+Private#Contacts
“Forward” report to the operator from the Google Groups web interface
Click on “Reply all” at the bottom of the email thread.
Change sender to “security@openedx.org”
Clear Cc: field to remove reporter’s email(s)
Add operator’s email to Cc: field
Change the subject prefix from “Re:” to “Fwd:”
Check any relevant attachments are still included.
Include a blurb, like below:
From: security@openedx.org Cc: <email of operator> Subject: Fwd: <original subject> We received the email below and believe it be a security report specific to your Open edX instance. We will inform the reporter that you will reach out to them if any additional information is required. Need help, or receive this email in error? Please let us know. Thanks, —Security WG
Post message
Reply all to the reporter’s original email so the email to the operator is not included in the thread.
The Reply all button should look like the above and is to the right of the header of the reporter’s original email.
Check the sender is still “security@openedx.org”
Click on the … at the bottom of the draft to check other emails are not included in the reply.