Potential stagnation of open issues on h1 bounty program

[phra]

Hello,

I've recently open few issues on the 3rd party modules h1 bounty program and I'm noticing a bit of delay in responses from the team, e.g. a bug that was fixed two months ago after I contacted the developer myself is still in triaged status without any response but h1 staff ones.

I understand the amount of effort involving managing the program itself but leaving open issues for a long time without any interaction can damage the whole initiative, especially when the only party not actively participating in the resolution are the program managers themselves.

Do you have any thoughts on how we can improve the bug hunters' experience by providing a smoother resolution and achieve more prompt reactions?

I maybe have a couple of suggestions already, that are:

1. predefining a standard flow/timeline that the staff can follow in order to contact the maintainer for a fix and/or disclosure of (un)patched issues in a reasonable amount of time? (like google project zero)
2. increase the number of people actively collaborating to the bounty program

I will be happy to hear from you what are your thoughts on this particular topic.

PS: I can eventually be available to help with the program in my spare time.

EDIT: regarding 1., I noticed that a process is already defined here.

[sam-github]

@phra Conversation is ongoing in #604 thta you may find relevant.

[phra]

thanks @sam-github

[lirantal]

I apologies for that @phra. We are way behind on many reports and have taken actionable steps previously too to ensure we prioritize correctly with the limited time folks here have but that's still hard.

We are welcoming others to join and have recently added a couple more but that's still not scalable with the amount of reports we're getting. I'm happy to hear any ideas you have on #604 as Sam mentioned.

[phra]

i have commented on #604

[mcollina]

I would let you know that the number of issues in the bounty program is too big and the situation is becoming untenable. There are weeks of full time work to exhaust that pipeline and no one who is going to do them.

[MarcinHoppe]

Should we stop accepting new reports until we decide on the new direction and act on that decision? I think we probably should.

[MarcinHoppe]

@nodejs/security-wg I'd love your opinion ☝️.

[mcollina]

Should we stop accepting new reports until we decide on the new direction and act on that decision? I think we probably should.

I think we should keep accepting them for projects/organizations that opted in.

[MarcinHoppe]

Fair point, I agree with that.

[DanielRuf]

I think we should keep accepting them for projects/organizations that opted in.

I agree with this.

Many of the current reports are probably the same findings in different packages and so far most maintainers did not react / answer after I have informed them (so far mostly the low priority bucket ones) so in my opinion this would be helpful to accept these which opted in.

[esarafianou]

I think we should keep accepting them for projects/organizations that opted in.

Where is a list of projects/organizations that opted in?

[phra]

Where is a list of projects/organizations that opted in?

@esarafianou i think they are referring to the repo/orgs list shown on Node.js third-party modules h1 page.

[MarcinHoppe]

We add assets for every new package we have a report for. This list does not represent packages where maintainers opted in to be part of the program.