Ever seen a security-related issue that you felt should be reported? Unsure of how reporting security issue is different than a regular bug? Developers of any level should know how to report a vulnerability.

In this talk, we will talk about what CVEs are, some general vulnerability classifications, look at a few common ways you can report security issues, as well as look at a few common mistakes.

This talk is geared toward non-security professionals.

Resources

The following resources were mentioned during the presentation or are useful additional information.

• Vulnerability Scoring Calculator
  
• ASF Project Security For Committers
  
• OWASP: Vulnerability Disclosure Cheat Sheet
  
• security.txt
  
• GitHub Private vulnerability reporting (beta)
  
• Build Speed Challenge (Free Swag)
  
• The Developer Productivity Engineering (DPE) Handbook
  
• Introduction to DPE (More Free Swag!)
  
• Gradle is Hiring