From bd3f27166b37cfde9349d31501cf0aa3401c7b61 Mon Sep 17 00:00:00 2001 From: Matteo Collina Date: Wed, 23 Apr 2025 17:42:25 +0200 Subject: [PATCH] meta: allow penetration testing on live system with prior authorization Signed-off-by: Matteo Collina PR-URL: https://github.com/nodejs/node/pull/57966 Reviewed-By: Chengzhong Wu Reviewed-By: Paolo Insogna Reviewed-By: Luigi Pinca Reviewed-By: Darshan Sen Reviewed-By: Marco Ippolito Reviewed-By: James M Snell Reviewed-By: Jordan Harband Reviewed-By: Antoine du Hamel Reviewed-By: Michael Dawson --- SECURITY.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index b932e83b29b..9650e812914 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -72,7 +72,9 @@ When reporting security vulnerabilities, reporters must adhere to the following 3. **Responsible Testing**: When testing potential vulnerabilities: * Use isolated, controlled environments. - * Do not test on production systems. + * Do not test on production systems without prior authorization. Contact + the Node.js Technical Steering Committee () for permission or open + a HackerOne report. * Do not attempt to access or modify other users' data. * Immediately stop testing if unauthorized access is gained accidentally.