How to Report a Security Vulnerability

If you think you've found a bug in Pidgin, Finch or libpurple that could potentially be exploited in a way that could harm users or prevent them from using the program (e.g. a remotely triggerable crash), please do not disclose the information publicly! Please do not tell people on the Pidgin devel mailing list, in the Pidgin IRC channel, or in the Pidgin Jabber conference room.

Instead, send an email to security@…. Emails to this address are sent to a core group of developers who will review the problem and take appropriate action.

Process for Developers

1. Acknowledge receipt of the bug.
   1. When a bug is reported to the security@… mailing list, reply to the reporter with an email based on this template:

       Thank you for reporting this problem to us!
       We will investigate it and make an appropriate fix.
       In the mean time, we ask that you please not disclose the problem to the public, yet!
       Please provide us with the following information: TODO
      

   2. If the bug has already been announced publicly (on devel mailing list, IRC, or Jabber conference), send all information about the bug to security@…
2. Developers on the security email list should determine an appropriate fix and create a patch.
3. Once an agreed upon patch has been created, an email based on this template should be sent to the packagers mailing list:

    Subject: Security Vulnerability
    Body: A security vulnerability has been discovered in [Pidgin|Finch|libpurple|other]
    Affected software: [e.x. "Pidgin 2.4.2-2.6.0", or "All clients based on libpurple 2.3.3-2.3.7"]
    Discovered by: [Name of company or individual]
    Public: ["no" or "yes as of YYYY-MM-DD"]
    Embargo date: [Either "none" or the agreed upon date]
   

4. Announce to the world, create new packages, update security page