[AGREEMENT] Gusted application to the security team #96

Gusted commented 2024年02月20日 10:23:33 +01:00

Application

I propose to become part of the security team.

1. If you agree, please simply add a 👍 to this issue.
2. If you disagree or have reservations, please write them in a comment below and I will do my best to address them.

This application follows the Forgejo decision making process (accepted after 2 weeks, unless concerns are raised).

Pledge

I pledge to act in accordance with the code of conduct, and all other rules and processes agreed via the Forgejo decision making process.

If there is an agreement for me to be a member of the team, I will consider applying again a year later.

I pledge to read and respond in a timely manner to mails sent to security@forgejo.org.

I pledge to follow the principles of Coordinated vulnerability disclosure.

Background

I am currently a member of the security team as per the agreement from last year.

I am definitely not a security professional and I have no formal training or education in computer science, security or cryptography. But I am a Go developer with 3 years of experience and 2.5 years of experience with the Forgejo codebase and have been a member of the Forgejo (before that Gitea) security team for the past 1.5 years.

On top of what the previous agreement listed, in the last year I've continued to work on creating patches for security vulnerabilities, analyzed incoming security reports and security vulnerabilities in dependencies that Forgejo uses and I've continued to do security research against the codebase to find security vulnerabilities, with success.

The following is a meaningless list of the public work I've done in the past year as part of the security team:

• https://forgejo.org/2023-02-17-release-v1-18-3-2/#security-issues-in-git & https://forgejo.org/2023-01-18-release-v1-18-1-0/#critical-security-issues-in-git: Analyzed if the Git vulnerabilities could be exploited in Forgejo.
• https://forgejo.org/2023-02-23-release-v1185-0: Analyzed and worked on creating the patch for the 'weak' password hashes.
• https://forgejo.org/2023-10-release-v1-20-5-0/#long-term-authentication-token: Found, analyzed, researched and worked on created a patch to rework the long term authentication token from scratch to be secure.
• https://forgejo.org/2023-11-release-v1-20-5-1/: Found and analyzed the vulnerable endpoints to manually crafting identifiers.

### Application I propose to become part of [the security team](https://codeberg.org/forgejo/governance/src/branch/main/TEAMS.md#security). 1. If you agree, please simply add a 👍 to this issue. 2. If you disagree or have reservations, please write them in a comment below and I will do my best to address them. This application follows the Forgejo [decision making process](https://codeberg.org/forgejo-contrib/governance/src/branch/main/DECISION-MAKING.md) (accepted after 2 weeks, unless concerns are raised). ### Pledge I pledge to act in accordance with the [code of conduct](https://codeberg.org/forgejo/code-of-conduct/), and all other rules and processes agreed via the Forgejo [decision making process](https://codeberg.org/forgejo-contrib/governance/src/branch/main/DECISION-MAKING.md). If there is an agreement for me to be a member of the team, I will consider applying again a year later. I pledge to read and respond in a timely manner to mails sent to `security@forgejo.org`. I pledge to follow the principles of [Coordinated vulnerability disclosure](https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure). ### Background I am currently a member of the security team as per [the agreement from last year](https://codeberg.org/forgejo/meta/issues/142). I am definitely not a security professional and I have no formal training or education in computer science, security or cryptography. But I am a Go developer with 3 years of experience and 2.5 years of experience with the Forgejo codebase and have been a member of the Forgejo (before that Gitea) security team for the past 1.5 years. On top of what [the previous agreement](https://codeberg.org/forgejo/meta/issues/142#user-content-background) listed, in the last year I've continued to work on creating patches for security vulnerabilities, analyzed incoming security reports and security vulnerabilities in dependencies that Forgejo uses and I've continued to do security research against the codebase to find security vulnerabilities, with success. The following is a meaningless list of the **public** work I've done in the past year as part of the security team: - https://forgejo.org/2023-02-17-release-v1-18-3-2/#security-issues-in-git & https://forgejo.org/2023-01-18-release-v1-18-1-0/#critical-security-issues-in-git: Analyzed if the Git vulnerabilities could be exploited in Forgejo. - https://forgejo.org/2023-02-23-release-v1185-0: Analyzed and worked on creating the patch for the 'weak' password hashes. - https://forgejo.org/2023-10-release-v1-20-5-0/#long-term-authentication-token: Found, analyzed, researched and worked on created a patch to rework the long term authentication token from scratch to be secure. - https://forgejo.org/2023-11-release-v1-20-5-1/: Found and analyzed the vulnerable endpoints to manually crafting identifiers.

earl-warren commented 2024年04月27日 11:02:56 +02:00

I think you can propose a PR to update the TEAMS file with your renewed commitment and close this issue.

I think you can propose a PR to update the TEAMS file with your renewed commitment and close this issue.