SEC: Add security disclosure process to developers page

[westurner]

http://pandas.pydata.org/developers.html

• https://mail.python.org/mailman/listinfo/pandas-dev

Examples:

• https://en.wikipedia.org/wiki/Responsible_disclosure
• https://docs.djangoproject.com/en/dev/internals/security/#reporting-security-issues

[jreback]

pls send me a private email and I'll take a look
git log will show my email addess

[westurner]

Resolved. Looks like I needed to update to the latest pandas release. Thanks!

[westurner]

Going forward, for your project, it would be good to have a documented process for fielding security issues.

[jreback]

@westurner I get that you want to raise these types of issues. But not sure that this is a pandas issue at all. It may be that the 'use' of pandas is incorrect, so possibly a doc note is in order as pandas is not directly web-facing.

[westurner]

It may be a healthy objective for the pandas project.

Examples:

• https://www.python.org/news/security
• https://docs.djangoproject.com/en/dev/internals/security/#reporting-security-issues

...

• https://www.owasp.org/index.php/Secure_SDLC_Cheat_Sheet#Related_articles
• http://csrc.nist.gov/publications/nistpubs/800-64-Rev2/SP800-64-Revision2.pdf (E-1)
• https://buildsecurityin.us-cert.gov/articles/knowledge/sdlc-process/secure-software-development-life-cycle-processes
• https://en.wikipedia.org/wiki/Responsible_disclosure

[jreback]

I get all this, but what can pandas actually do about this?

[jreback]

ahh, you want to make this a doc issue, ok with that.

[jreback]

@westurner ok pull-request for 0.15.1 then!

[westurner]

Document what process for documenting issues and resolution are optimal in a security sensitive context. (e.g. link to a mailing list, or whatever you feel is appropriate)