Point security reporting address at the ASF Security Team - #706
Open
ppkarwasz wants to merge 1 commit into
Open
Conversation
The page told reporters to email security@spark.apache.org. That list was sunset at the beginning of 2026 and mail to it is redirected to security@apache.org, so reports still arrive, but the page advertises an address that survives only by redirect and disagrees with security.apache.org/projects, which gives Spark's security contact as security@apache.org with a Spark subject while linking this page as Spark's advisories page. Name the ASF Security Team directly and, while here: - ask reporters to confirm the deployment under test is configured according to the Spark Security documentation before reporting, since Spark's security features are opt-in and no deployment mode is secure by default - point at the FAQ below, which already documents the by-design behavior behind the most frequently rejected reports - restate the ASF request for one plain-text, unencrypted email per vulnerability, in the message body rather than as an attachment - give the FAQ heading an id so it can be linked, matching the explicit ids the CVE headings on this page already carry site/security.html is the regenerated Jekyll output. Assisted-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changes were proposed in this pull request?
security.md, in the "Reporting security issues" section:security@apache.org, replacingsecurity@spark.apache.org.id, so the new text can link to it. The CVE headings on the same page already carry explicit ids.site/security.htmlis the regenerated Jekyll output for that page.Why are the changes needed?
The page currently says:
That list was sunset at the beginning of 2026, and mail addressed to it is redirected to
security@apache.org. Reports are therefore not lost, but the page advertises an address that survives only by redirect, and it disagrees with security.apache.org/projects, which gives Spark's security contact assecurity@apache.orgwhile linking this page as Spark's advisories page. Naming the ASF Security Team directly removes the discrepancy.The two pre-report checks address the most common categories of invalid report the project receives: findings against deployments left in their insecure-by-default state, and findings that amount to "Spark executes the code it was given", which the FAQ on this page has documented as by design for some time. Pointing at both before the reporting address should cut down on reports that have to be rejected.
A companion change to
SECURITY.mdin the main repository is at apache/spark#57844.Does this PR introduce any user-facing change?
Yes, to the website only: the reporting address on https://spark.apache.org/security.html changes, and the section gains the pre-report checks.
How was this patch tested?
site/security.htmlwas regenerated with the pinned toolchain fromGemfile.lock(Jekyll 4.4.1, Rouge 3.26.0, Ruby 3.2) and the rendered page was checked in a browser.Was this patch authored or co-authored using generative AI tooling?
Generated-by: Claude Code (Claude Opus 5)