[Bug] Issue template points vulnerability reports at the wrong address #507

New issue

Closed

opened 2026-07-22 08:47:42 +00:00 by brenno · 0 comments

brenno commented

2026-07-22 08:47:42 +00:00

Owner

Describe the bug

.github/ISSUE_TEMPLATE/config.yml:4 sends security reports to
security@vigilis.nl. SECURITY.md:13 and CODE_OF_CONDUCT.md:144 both say
security@librekat.nl. Someone following the tracker's own "report privately"
link mails an address the project's own documentation does not recognise.

Expected behaviour

One address, everywhere: security@librekat.nl.

Additional context

No check guards this — the address appears in three files and nothing compares
them. Worth a small consistency test alongside test/docs_registration_test.dart,
which already reads files from disk for exactly this kind of guard.

**Describe the bug** `.github/ISSUE_TEMPLATE/config.yml:4` sends security reports to `security@vigilis.nl`. `SECURITY.md:13` and `CODE_OF_CONDUCT.md:144` both say `security@librekat.nl`. Someone following the tracker's own "report privately" link mails an address the project's own documentation does not recognise. **Expected behaviour** One address, everywhere: `security@librekat.nl`. **Additional context** No check guards this — the address appears in three files and nothing compares them. Worth a small consistency test alongside `test/docs_registration_test.dart`, which already reads files from disk for exactly this kind of guard.

brenno added the

accepted

docs

bug

labels

2026-07-22 08:47:42 +00:00

brenno referenced this issue from a commit

2026-07-22 10:12:30 +00:00

fix(meldadres): stuur kwetsbaarheidsmeldingen naar security@librekat.nl

brenno referenced this issue from a pull request that will close it,

2026-07-22 10:12:46 +00:00

fix: stuur kwetsbaarheidsmeldingen naar het adres dat we zelf documenteren #523