Skip to content

Responsible disclosure policy #7052

Closed

Description

@JamieSlome

Hey there!

I belong to an open source security research community, and a member (@whokilleddb) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

Activity

  1. github-actions commented on Mar 20, 2022

    @github-actions
    Contributor

    👋 Hello @JamieSlome, thank you for your interest in YOLOv5 🚀! Please visit our ⭐️ Tutorials to get started, where you can find quickstart guides for simple tasks like Custom Data Training all the way to advanced concepts like Hyperparameter Evolution.

    If this is a 🐛 Bug Report, please provide screenshots and minimum viable code to reproduce your issue, otherwise we can not help you.

    If this is a custom training ❓ Question, please provide as much information as possible, including dataset images, training logs, screenshots, and a public link to online W&B logging if available.

    For business inquiries or professional support requests please visit https://ultralytics.com or email support@ultralytics.com.

    Requirements

    Python>=3.7.0 with all requirements.txt installed including PyTorch>=1.7. To get started:

    git clone https://github.com/ultralytics/yolov5  # clone
    cd yolov5
    pip install -r requirements.txt  # install

    Environments

    YOLOv5 may be run in any of the following up-to-date verified environments (with all dependencies including CUDA/CUDNN, Python and PyTorch preinstalled):

    Status

    CI CPU testing

    If this badge is green, all YOLOv5 GitHub Actions Continuous Integration (CI) tests are currently passing. CI tests verify correct operation of YOLOv5 training (train.py), validation (val.py), inference (detect.py) and export (export.py) on MacOS, Windows, and Ubuntu every 24 hours and on every commit.

  2. added a commit that references this issue on Mar 20, 2022
  3. added a commit that references this issue on Mar 20, 2022
  4. glenn-jocher commented on Mar 20, 2022

    @glenn-jocher
    Member

    @JamieSlome good news 😃! Your original issue may now be fixed ✅ in PR #7054. This PR creates SECURITY.md in the .github directory: https://github.com/ultralytics/yolov5/blob/master/.github/SECURITY.md

    To receive this update:

    • Git – git pull from within your yolov5/ directory or git clone https://github.com/ultralytics/yolov5 again
    • PyTorch Hub – Force-reload model = torch.hub.load('ultralytics/yolov5', 'yolov5s', force_reload=True)
    • Notebooks – View updated notebooks Open In Colab Open In Kaggle
    • Docker – sudo docker pull ultralytics/yolov5:latest to update your image Docker Pulls

    Thank you for spotting this issue and informing us of the problem. Please let us know if this update resolves the issue for you, and feel free to inform us of any other issues you discover or feature requests that come to mind. Happy trainings with YOLOv5 🚀!

  5. JamieSlome commented on Mar 21, 2022

    @JamieSlome
    ContributorAuthor

    @glenn-jocher - amazing, thanks for such a swift and detailed response, wow! ⚡

    We have already sent an e-mail to your elected e-mail address, but just for reference, you can find both reports here:

    https://huntr.dev/bounties/6cc53b5d-d3ca-4a74-b0a4-0708d3fdb839/
    https://huntr.dev/bounties/0a3c5920-907a-4b7b-82d6-d1ecacd62b91/

    They are both private and only accessible to maintainers with repository write permissions. Let me know if you have any questions.

  6. added a commit that references this issue on Aug 26, 2022
  7. added a commit that references this issue on May 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions