[SEC-WG]: Try IRP with a sample bug

[evenstensberg]

Let's try out how the IRP is.

[avivkeller]

As a reminder, the IRP generally follows the below diagram

flowchart TD
    classDef reportNode fill:#d4f0fd,stroke:#0078d7,stroke-width:1px,color:#222
    classDef triageNode fill:#d8ebdc,stroke:#217346,stroke-width:1px,color:#222
    classDef containNode fill:#fcf0cf,stroke:#b7472a,stroke-width:1px,color:#222
    classDef fixNode fill:#e1d2f9,stroke:#5e35b1,stroke-width:1px,color:#222
    classDef releaseNode fill:#ffccbc,stroke:#e64a19,stroke-width:1px,color:#222

    classDef subgraph1 fill:#eef7fb,stroke:#0078d7,stroke-width:2px,color:#222
    classDef subgraph2 fill:#f2f8f3,stroke:#217346,stroke-width:2px,color:#222
    classDef subgraph3 fill:#fef9e7,stroke:#b7472a,stroke-width:2px,color:#222
    classDef subgraph4 fill:#f5f0fa,stroke:#5e35b1,stroke-width:2px,color:#222
    classDef subgraph5 fill:#fff4f0,stroke:#e64a19,stroke-width:2px,color:#222

    subgraph sg1["1. Report Received"]
        A1["Reporter submits report"] --> A2{"Submission Channel"}
        A2 -->|"Preferred"| A3["GitHub Security Advisories"]
        A2 -->|"Alternative"| A4["Email: webpack-security@openjsf.org"]
        A3 --> A5["Report received"]
        A4 --> A5
        subgraph sg1a["Response Time"]
            A6{"Vulnerability Type?"}
            A7["Standard: Acknowledge within 30 days"]
            A8["Critical: Acknowledge within 7 days"]
        end
        A5 --> A6
        A6 -->|"Standard"| A7
        A6 -->|"Zero-day/Critical"| A8
    end

    subgraph sg2["2. Triage & Assessment"]
        B1["Security Maintainer validates report"] --> B2{"Security Related?"}
        B2 -->|"No"| B3["Handle as regular issue"]
        B2 -->|"Yes"| B4["Classify severity"]
        subgraph sg2a["Classification"]
            B5a["Critical"]
            B5b["High"]
            B5c["Medium"]
            B5d["Low"]
        end
        B4 --> B5a
        B4 --> B5b
        B4 --> B5c
        B4 --> B5d
        B5a & B5b & B5c & B5d --> B6["Determine impact and scope"]
        B6 --> B7["Identify affected versions/configurations"]
    end

    subgraph sg3["3. Containment & Private Fix"]
        C1["Create private working group"] --> C2["Use GitHub private fork or draft advisory"]
        C2 --> C3["Explore temporary mitigations"]
        C3 --> C4["Maintain confidentiality"]
    end

    subgraph sg4["4. Fix & Testing"]
        D1["Develop fix privately"] --> D2["Review fix"]
        D2 --> D3["Add regression tests"]
        D3 --> D4{"Multiple versions affected?"}
        D4 -->|"Yes"| D5["Backport fixes to supported major versions"]
        D4 -->|"No"| D6["Finalize fix"]
        D5 --> D6
    end

    subgraph sg5["5. Release"]
        E1["Publish patched release"] --> E2["Publish security advisory"]
        subgraph sg5a["Advisory Contents"]
            E3["Description of issue"]
            E4["Impacted versions"]
            E5["Severity rating"]
            E6["Mitigation/upgrade steps"]
        end
        E2 --> E3 & E4 & E5 & E6
    end

    A7 & A8 --> B1
    B7 --> C1
    C4 --> D1
    D6 --> E1

    class A1,A2,A3,A4,A5,A6,A7,A8 reportNode
    class B1,B2,B3,B4,B5a,B5b,B5c,B5d,B6,B7 triageNode
    class C1,C2,C3,C4 containNode
    class D1,D2,D3,D4,D5,D6 fixNode
    class E1,E2,E3,E4,E5,E6 releaseNode

    class sg1 subgraph1
    class sg2 subgraph2
    class sg3 subgraph3
    class sg4 subgraph4
    class sg5 subgraph5

Loading