Comment on XSS vulnerability found in GithubparentComments−durin4215yEnd-users aren't who you need to tell. Just site owners. Posting this to HN before it was fixed constitutes (IMO) completely irresponsible disclosure.−mike-cardwell15yI agree. I would not have disclosed this particular XSS flaw until after it was fixed.−StukOP15yYes, soon after posting I realised it wasn't the best idea I've ever had. I regret posting this before the Github guys got a chance to fix the hole. Not something I'm going to repeat.−vulf15yYou should report to security@github.com next time.
Comments
End-users aren't who you need to tell. Just site owners. Posting this to HN before it was fixed constitutes (IMO) completely irresponsible disclosure.
I agree. I would not have disclosed this particular XSS flaw until after it was fixed.
Yes, soon after posting I realised it wasn't the best idea I've ever had. I regret posting this before the Github guys got a chance to fix the hole. Not something I'm going to repeat.
You should report to security@github.com next time.