{"action":"created","comment":{"url":"https://api.github.com/repos/nodejs/security-wg/pulls/comments/148652020","pull_request_review_id":73930699,"id":148652020,"diff_hunk":"@@ -0,0 +1,63 @@\n+# Security WG meeting 2017-11-02\n+\n+GitHub issue: https://github.com/nodejs/security-wg/issues/63\n+Meeting video: https://youtu.be/UWKC1GTPAFo\n+Previous meeting: https://github.com/nodejs/security-wg/blob/master/meetings/2017-10-12.md\n+\n+\n+# Present\n+\n+- Bryan English (@bengl)\n+- Sam Roberts (@sam-github)\n+- Vladimir de Turckheim (@vdeturckheim)\n+- Michael Alexander (@mgalexander)\n+- Michael Dawson (@mhdawson)\n+- Reed Loden (@reedloden)\n+- Colin Ihrig (@cjihrig)\n+- Arunesh Chandra (@aruneshchandra)-observer\n+- Hitesh Kanwathirtha (@digitalinfinity)-observer\n+- Adam Baldwin - late (@evilpacket)\n+\n+# Review of last meeting\n+\n+\n+# New agenda\n+\n+## Hacker one setup/demo\n+\n+* @vdeturckheim gave us a walkthrough of what he has setup.\n+* Easy to invite people to collaborate on specific vulnerabilities\n+*\n+\n+##  Bug Bounty Program https://github.com/nodejs/security-wg/issues/49\n+\n+* want to add bounties Node.js to list they provide bounties for.\n+* not a huge amount of money ($1500 at the top end)\n+* does provide some additional motivation for researchers to find/report\n+  Issues.\n+* There is no cost to the project (Internet bug bounty would provide for free)\n+* Only for security vulnerabilities, do they need to go through hacker one.\n+* Needs to meet some minimum bar.\n+* Michael: should probably get hacker one setup done first ?\n+* Michael Alexander volunteered to champion this on the Security-wg, like with an\n+  end of year timeframe.\n+\n+## Proposing an Early Disclosure Program  https://github.com/nodejs/security-wg/issues/58\n+\n+* One thing discussed was to get more input from the potential consumers\n+* Vladimir will put together and issue, twitter etc to try to gather that input.\n+\n+## acknowledge privacy of info in private repos.https://github.com/nodejs/security-wg/issues/64\n+\n+* general consensus that having document and having people acknowledge in issue 64 is good\n+  enough\n+\n+# Actions\n+\n+* @vdeturckheim to set up meeting with Core triage team to handover HackerOne Organization (https://github.com/nodejs/security-wg/blob/master/processes/security_team_members.md#team-that-triages-security-reports-against-node-core)\n+* Discuss issue linked with potential confusion between 2 HackerOne orgs from security reporters\n+* @vdeturckheim to create email alias for 3rd party vulnerability report\n+* @vdeturckheim to open an issue to open an issue to collect inputs regarding early disclosure. \n+* @mgalexander prepare proposal for bug bounty\n+* @bengl agreed to socialize the discussion around security team membership (need to confirm)","path":"meetings/2017-11-02.md","position":62,"original_position":62,"commit_id":"049c2e54537528e967249926910f16f6dcd6688c","original_commit_id":"049c2e54537528e967249926910f16f6dcd6688c","user":{"login":"bengl","id":110455,"avatar_url":"https://avatars2.githubusercontent.com/u/110455?v=4","gravatar_id":"","url":"https://api.github.com/users/bengl","html_url":"https://github.com/bengl","followers_url":"https://api.github.com/users/bengl/followers","following_url":"https://api.github.com/users/bengl/following{/other_user}","gists_url":"https://api.github.com/users/bengl/gists{/gist_id}","starred_url":"https://api.github.com/users/bengl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bengl/subscriptions","organizations_url":"https://api.github.com/users/bengl/orgs","repos_url":"https://api.github.com/users/bengl/repos","events_url":"https://api.github.com/users/bengl/events{/privacy}","received_events_url":"https://api.github.com/users/bengl/received_events","type":"User","site_admin":false},"body":"This isn't quite what I thought I agreed to. I'll re-listen to the audio and get back to you with a better wording of this.","created_at":"2017-11-02T20:35:38Z","updated_at":"2017-11-02T20:35:38Z","html_url":"https://github.com/nodejs/security-wg/pull/65#discussion_r148652020","pull_request_url":"https://api.github.com/repos/nodejs/security-wg/pulls/65","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/nodejs/security-wg/pulls/comments/148652020"},"html":{"href":"https://github.com/nodejs/security-wg/pull/65#discussion_r148652020"},"pull_request":{"href":"https://api.github.com/repos/nodejs/security-wg/pulls/65"}}},"pull_request":{"url":"https://api.github.com/repos/nodejs/security-wg/pulls/65","id":150395525,"html_url":"https://github.com/nodejs/security-wg/pull/65","diff_url":"https://github.com/nodejs/security-wg/pull/65.diff","patch_url":"https://github.com/nodejs/security-wg/pull/65.patch","issue_url":"https://api.github.com/repos/nodejs/security-wg/issues/65","number":65,"state":"open","locked":false,"title":"Nov 2 meeting minutes","user":{"login":"mgalexander","id":582234,"avatar_url":"https://avatars1.githubusercontent.com/u/582234?v=4","gravatar_id":"","url":"https://api.github.com/users/mgalexander","html_url":"https://github.com/mgalexander","followers_url":"https://api.github.com/users/mgalexander/followers","following_url":"https://api.github.com/users/mgalexander/following{/other_user}","gists_url":"https://api.github.com/users/mgalexander/gists{/gist_id}","starred_url":"https://api.github.com/users/mgalexander/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mgalexander/subscriptions","organizations_url":"https://api.github.com/users/mgalexander/orgs","repos_url":"https://api.github.com/users/mgalexander/repos","events_url":"https://api.github.com/users/mgalexander/events{/privacy}","received_events_url":"https://api.github.com/users/mgalexander/received_events","type":"User","site_admin":false},"body":"I did add an **acton** for @bengl at the end -- we did not seem to note what I think I recall as an action to pull together a group membership process doc. Please confirm.","created_at":"2017-11-02T20:27:25Z","updated_at":"2017-11-02T20:35:38Z","closed_at":null,"merged_at":null,"merge_commit_sha":"d8354129dd296c93ce8bcd5acfaa2ecefd68ca21","assignee":null,"assignees":[],"requested_reviewers":[],"milestone":null,"commits_url":"https://api.github.com/repos/nodejs/security-wg/pulls/65/commits","review_comments_url":"https://api.github.com/repos/nodejs/security-wg/pulls/65/comments","review_comment_url":"https://api.github.com/repos/nodejs/security-wg/pulls/comments{/number}","comments_url":"https://api.github.com/repos/nodejs/security-wg/issues/65/comments","statuses_url":"https://api.github.com/repos/nodejs/security-wg/statuses/049c2e54537528e967249926910f16f6dcd6688c","head":{"label":"mgalexander:master","ref":"master","sha":"049c2e54537528e967249926910f16f6dcd6688c","user":{"login":"mgalexander","id":582234,"avatar_url":"https://avatars1.githubusercontent.com/u/582234?v=4","gravatar_id":"","url":"https://api.github.com/users/mgalexander","html_url":"https://github.com/mgalexander","followers_url":"https://api.github.com/users/mgalexander/followers","following_url":"https://api.github.com/users/mgalexander/following{/other_user}","gists_url":"https://api.github.com/users/mgalexander/gists{/gist_id}","starred_url":"https://api.github.com/users/mgalexander/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mgalexander/subscriptions","organizations_url":"https://api.github.com/users/mgalexander/orgs","repos_url":"https://api.github.com/users/mgalexander/repos","events_url":"https://api.github.com/users/mgalexander/events{/privacy}","received_events_url":"https://api.github.com/users/mgalexander/received_events","type":"User","site_admin":false},"repo":{"id":109313319,"name":"security-wg","full_name":"mgalexander/security-wg","owner":{"login":"mgalexander","id":582234,"avatar_url":"https://avatars1.githubusercontent.com/u/582234?v=4","gravatar_id":"","url":"https://api.github.com/users/mgalexander","html_url":"https://github.com/mgalexander","followers_url":"https://api.github.com/users/mgalexander/followers","following_url":"https://api.github.com/users/mgalexander/following{/other_user}","gists_url":"https://api.github.com/users/mgalexander/gists{/gist_id}","starred_url":"https://api.github.com/users/mgalexander/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mgalexander/subscriptions","organizations_url":"https://api.github.com/users/mgalexander/orgs","repos_url":"https://api.github.com/users/mgalexander/repos","events_url":"https://api.github.com/users/mgalexander/events{/privacy}","received_events_url":"https://api.github.com/users/mgalexander/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/mgalexander/security-wg","description":"Node.js Security Working Group","fork":true,"url":"https://api.github.com/repos/mgalexander/security-wg","forks_url":"https://api.github.com/repos/mgalexander/security-wg/forks","keys_url":"https://api.github.com/repos/mgalexander/security-wg/keys{/key_id}","collaborators_url":"https://api.github.com/repos/mgalexander/security-wg/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/mgalexander/security-wg/teams","hooks_url":"https://api.github.com/repos/mgalexander/security-wg/hooks","issue_events_url":"https://api.github.com/repos/mgalexander/security-wg/issues/events{/number}","events_url":"https://api.github.com/repos/mgalexander/security-wg/events","assignees_url":"https://api.github.com/repos/mgalexander/security-wg/assignees{/user}","branches_url":"https://api.github.com/repos/mgalexander/security-wg/branches{/branch}","tags_url":"https://api.github.com/repos/mgalexander/security-wg/tags","blobs_url":"https://api.github.com/repos/mgalexander/security-wg/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/mgalexander/security-wg/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/mgalexander/security-wg/git/refs{/sha}","trees_url":"https://api.github.com/repos/mgalexander/security-wg/git/trees{/sha}","statuses_url":"https://api.github.com/repos/mgalexander/security-wg/statuses/{sha}","languages_url":"https://api.github.com/repos/mgalexander/security-wg/languages","stargazers_url":"https://api.github.com/repos/mgalexander/security-wg/stargazers","contributors_url":"https://api.github.com/repos/mgalexander/security-wg/contributors","subscribers_url":"https://api.github.com/repos/mgalexander/security-wg/subscribers","subscription_url":"https://api.github.com/repos/mgalexander/security-wg/subscription","commits_url":"https://api.github.com/repos/mgalexander/security-wg/commits{/sha}","git_commits_url":"https://api.github.com/repos/mgalexander/security-wg/git/commits{/sha}","comments_url":"https://api.github.com/repos/mgalexander/security-wg/comments{/number}","issue_comment_url":"https://api.github.com/repos/mgalexander/security-wg/issues/comments{/number}","contents_url":"https://api.github.com/repos/mgalexander/security-wg/contents/{+path}","compare_url":"https://api.github.com/repos/mgalexander/security-wg/compare/{base}...{head}","merges_url":"https://api.github.com/repos/mgalexander/security-wg/merges","archive_url":"https://api.github.com/repos/mgalexander/security-wg/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/mgalexander/security-wg/downloads","issues_url":"https://api.github.com/repos/mgalexander/security-wg/issues{/number}","pulls_url":"https://api.github.com/repos/mgalexander/security-wg/pulls{/number}","milestones_url":"https://api.github.com/repos/mgalexander/security-wg/milestones{/number}","notifications_url":"https://api.github.com/repos/mgalexander/security-wg/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/mgalexander/security-wg/labels{/name}","releases_url":"https://api.github.com/repos/mgalexander/security-wg/releases{/id}","deployments_url":"https://api.github.com/repos/mgalexander/security-wg/deployments","created_at":"2017-11-02T20:06:02Z","updated_at":"2017-10-28T07:46:29Z","pushed_at":"2017-11-02T20:17:20Z","git_url":"git://github.com/mgalexander/security-wg.git","ssh_url":"git@github.com:mgalexander/security-wg.git","clone_url":"https://github.com/mgalexander/security-wg.git","svn_url":"https://github.com/mgalexander/security-wg","homepage":null,"size":201,"stargazers_count":0,"watchers_count":0,"language":null,"has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"nodejs:master","ref":"master","sha":"c2bf31b79e67849b0dcbac9f587795442137dfde","user":{"login":"nodejs","id":9950313,"avatar_url":"https://avatars3.githubusercontent.com/u/9950313?v=4","gravatar_id":"","url":"https://api.github.com/users/nodejs","html_url":"https://github.com/nodejs","followers_url":"https://api.github.com/users/nodejs/followers","following_url":"https://api.github.com/users/nodejs/following{/other_user}","gists_url":"https://api.github.com/users/nodejs/gists{/gist_id}","starred_url":"https://api.github.com/users/nodejs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nodejs/subscriptions","organizations_url":"https://api.github.com/users/nodejs/orgs","repos_url":"https://api.github.com/users/nodejs/repos","events_url":"https://api.github.com/users/nodejs/events{/privacy}","received_events_url":"https://api.github.com/users/nodejs/received_events","type":"Organization","site_admin":false},"repo":{"id":75093520,"name":"security-wg","full_name":"nodejs/security-wg","owner":{"login":"nodejs","id":9950313,"avatar_url":"https://avatars3.githubusercontent.com/u/9950313?v=4","gravatar_id":"","url":"https://api.github.com/users/nodejs","html_url":"https://github.com/nodejs","followers_url":"https://api.github.com/users/nodejs/followers","following_url":"https://api.github.com/users/nodejs/following{/other_user}","gists_url":"https://api.github.com/users/nodejs/gists{/gist_id}","starred_url":"https://api.github.com/users/nodejs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nodejs/subscriptions","organizations_url":"https://api.github.com/users/nodejs/orgs","repos_url":"https://api.github.com/users/nodejs/repos","events_url":"https://api.github.com/users/nodejs/events{/privacy}","received_events_url":"https://api.github.com/users/nodejs/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/nodejs/security-wg","description":"Node.js Security Working Group","fork":false,"url":"https://api.github.com/repos/nodejs/security-wg","forks_url":"https://api.github.com/repos/nodejs/security-wg/forks","keys_url":"https://api.github.com/repos/nodejs/security-wg/keys{/key_id}","collaborators_url":"https://api.github.com/repos/nodejs/security-wg/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/nodejs/security-wg/teams","hooks_url":"https://api.github.com/repos/nodejs/security-wg/hooks","issue_events_url":"https://api.github.com/repos/nodejs/security-wg/issues/events{/number}","events_url":"https://api.github.com/repos/nodejs/security-wg/events","assignees_url":"https://api.github.com/repos/nodejs/security-wg/assignees{/user}","branches_url":"https://api.github.com/repos/nodejs/security-wg/branches{/branch}","tags_url":"https://api.github.com/repos/nodejs/security-wg/tags","blobs_url":"https://api.github.com/repos/nodejs/security-wg/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/nodejs/security-wg/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/nodejs/security-wg/git/refs{/sha}","trees_url":"https://api.github.com/repos/nodejs/security-wg/git/trees{/sha}","statuses_url":"https://api.github.com/repos/nodejs/security-wg/statuses/{sha}","languages_url":"https://api.github.com/repos/nodejs/security-wg/languages","stargazers_url":"https://api.github.com/repos/nodejs/security-wg/stargazers","contributors_url":"https://api.github.com/repos/nodejs/security-wg/contributors","subscribers_url":"https://api.github.com/repos/nodejs/security-wg/subscribers","subscription_url":"https://api.github.com/repos/nodejs/security-wg/subscription","commits_url":"https://api.github.com/repos/nodejs/security-wg/commits{/sha}","git_commits_url":"https://api.github.com/repos/nodejs/security-wg/git/commits{/sha}","comments_url":"https://api.github.com/repos/nodejs/security-wg/comments{/number}","issue_comment_url":"https://api.github.com/repos/nodejs/security-wg/issues/comments{/number}","contents_url":"https://api.github.com/repos/nodejs/security-wg/contents/{+path}","compare_url":"https://api.github.com/repos/nodejs/security-wg/compare/{base}...{head}","merges_url":"https://api.github.com/repos/nodejs/security-wg/merges","archive_url":"https://api.github.com/repos/nodejs/security-wg/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/nodejs/security-wg/downloads","issues_url":"https://api.github.com/repos/nodejs/security-wg/issues{/number}","pulls_url":"https://api.github.com/repos/nodejs/security-wg/pulls{/number}","milestones_url":"https://api.github.com/repos/nodejs/security-wg/milestones{/number}","notifications_url":"https://api.github.com/repos/nodejs/security-wg/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/nodejs/security-wg/labels{/name}","releases_url":"https://api.github.com/repos/nodejs/security-wg/releases{/id}","deployments_url":"https://api.github.com/repos/nodejs/security-wg/deployments","created_at":"2016-11-29T15:16:52Z","updated_at":"2017-10-28T07:46:29Z","pushed_at":"2017-11-02T20:27:26Z","git_url":"git://github.com/nodejs/security-wg.git","ssh_url":"git@github.com:nodejs/security-wg.git","clone_url":"https://github.com/nodejs/security-wg.git","svn_url":"https://github.com/nodejs/security-wg","homepage":null,"size":201,"stargazers_count":14,"watchers_count":14,"language":null,"has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":10,"mirror_url":null,"archived":false,"open_issues_count":12,"forks":10,"open_issues":12,"watchers":14,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/nodejs/security-wg/pulls/65"},"html":{"href":"https://github.com/nodejs/security-wg/pull/65"},"issue":{"href":"https://api.github.com/repos/nodejs/security-wg/issues/65"},"comments":{"href":"https://api.github.com/repos/nodejs/security-wg/issues/65/comments"},"review_comments":{"href":"https://api.github.com/repos/nodejs/security-wg/pulls/65/comments"},"review_comment":{"href":"https://api.github.com/repos/nodejs/security-wg/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/nodejs/security-wg/pulls/65/commits"},"statuses":{"href":"https://api.github.com/repos/nodejs/security-wg/statuses/049c2e54537528e967249926910f16f6dcd6688c"}},"author_association":"NONE"}}
{"actor":{"display_login":"bengl"}}