297
edits
Security/Web Bug Rotation: Difference between revisions
Jump to navigation
Jump to search
update bounty handling text
(→NEW: update instructions) |
(update bounty handling text) |
||
| Line 39: | Line 39: | ||
### sec-{critical,high,moderate,low,other}, see [https://wiki.mozilla.org/WebAppSec/Web_App_Severity_Ratings#Severity_Ratings severity ratings] | ### sec-{critical,high,moderate,low,other}, see [https://wiki.mozilla.org/WebAppSec/Web_App_Severity_Ratings#Severity_Ratings severity ratings] | ||
### wsec-{authentication,cookie,xss,sqli,...}, see [https://wiki.mozilla.org/WebAppSec/Web_App_Severity_Ratings#Group_Keywords vulnerability types] | ### wsec-{authentication,cookie,xss,sqli,...}, see [https://wiki.mozilla.org/WebAppSec/Web_App_Severity_Ratings#Group_Keywords vulnerability types] | ||
## Edit "Assigned To" and check the box for "Reset Assignee to default" | ## Edit "Assigned To" and check the box for "Reset Assignee to default" | ||
# If the verification shows that the issue is invalid, close the bug as '''INVALID''' | # If the verification shows that the issue is invalid, close the bug as '''INVALID''' | ||
| Line 48: | Line 46: | ||
=Bounty= | =Bounty= | ||
# Bounty flags are set automatically through the [https://bugzilla.mozilla.org/form.web.bounty Web Bounty Form]. | |||
# Check the Web Bounty FAQ for whether the site and service are in scope for the bounty program. | |||
## If the site is not on the [https://www.mozilla.org/en-US/security/bug-bounty/faq-webapp/#eligible-bugs eligible list] and the bug is not "extraordinary" please set the bug-bounty flag to "-" and needinfo flag :adamm. | |||
# If a submitter requests that a bug submitted outside the automated form have a bounty flag added, set the bounty flag to "?" and needinfo :adamm. | |||
For '''NEW''' bugs | For '''NEW''' bugs | ||
| Line 63: | Line 63: | ||
## If the old bug has the attachment 'bounty non-qual' or similar then set sec-bounty- on the old bug | ## If the old bug has the attachment 'bounty non-qual' or similar then set sec-bounty- on the old bug | ||
## If the old bug has the attachment 'bounty awarded X' or 'bounty paid X', then set sec-bounty+ on the old bug | ## If the old bug has the attachment 'bounty awarded X' or 'bounty paid X', then set sec-bounty+ on the old bug | ||
## | ## If no duplicate is found and the issue is not verified the bug shall be RESOLVED - INVALID and the whiteboard tag removed. | ||