Re: Where should security issues with GNU ELPA packages be reported?

[Philip Kaludercic]

Morgan Willcock <morgan@ice9.digital> writes:

> I think I have found a security issue with a package which is
> distributed on GNU ELPA, and I am unsure who to notify.
>
> Given that the package is technically part of Emacs, do I follow
> whatever the procedure would be for disclosing security problems with
> Emacs?  If so, what is that procedure?
>
> Or should I e-mail the package author first?
>
> Given that it is not the package author who is distributing the package,
> I am unsure what to do.

It would probably be better to message the maintainer first, if there is
no explicit maintainer you can check elpa.git to infer who is
responsible.  Can you disclose what package you are concerned about?

-- 
        Philip Kaludercic on peregrine