VULN-DISCLOSURE-POLICY.md: use hackerone

- bug_report.yml: use hackerone

Closes #20683

diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 0bcfd2dab42d23db2d4f1d0efbda5bc7618799e7..c2b79901afbdc0f08357fdd2a156a456dc2456e3 100644 (file)
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -13,7 +13,7 @@ body:
 
         Only file bugs here! Ask questions on the mailing lists https://curl.se/mail/
 
-        **SECURITY RELATED?** Submit here: https://github.com/curl/curl/security/advisories
+        **SECURITY RELATED?** Submit here: https://hackerone.com/curl
 
   - type: textarea
     id: reproducer

diff --git a/docs/VULN-DISCLOSURE-POLICY.md b/docs/VULN-DISCLOSURE-POLICY.md
index f9555320d752a67f7524a1ab27d61cd775c53648..e6562bc1a2fc8d46ceea527cb61b7234859ee766 100644 (file)
--- a/docs/VULN-DISCLOSURE-POLICY.md
+++ b/docs/VULN-DISCLOSURE-POLICY.md
@@ -29,10 +29,9 @@ mailing lists. Messages associated with any commits should not make any
 reference to the security nature of the commit if done prior to the public
 announcement.
 
-- The person discovering the issue, the reporter, reports the vulnerability to
-  the curl project. Do this [on
-  GitHub](https://github.com/curl/curl/security/advisories). Such submissions
-  reach a handful of selected and trusted people.
+- The person discovering the issue, the reporter, reports the vulnerability on
+  [HackerOne](https://hackerone.com/curl). Issues filed there reach a handful
+  of selected and trusted people.
 
 - Messages that do not relate to the reporting or managing of an undisclosed
   security vulnerability in curl or libcurl are ignored and no further action
@@ -99,23 +98,6 @@ announcement.
 - The security webpage on the website should get the new vulnerability
   mentioned.
 
-## GitHub Advisories
-
-We receive *advisories* submitted on GitHub but we consider them to be
-*reports*. Since we want to keep the original report as-is and preserved, we
-cannot use this system to author nor publish the actual final advisory for a
-confirmed vulnerability.
-
-The security reports submitted on GitHub are not published, instead they are
-always closed weather confirmed or not.
-
-Confirmed security reports are instead published as security advisories on the
-curl website in sync with the curl release in which the fix is published for
-the vulnerability.
-
-Unfortunately, GitHub does not allow us to disclose the reports. They can only
-be published as "advisories" - and they are not.
-
 ## security (at curl dot se)
 
 This is a private mailing list for discussions on and about curl security