This policy describes how security related issues are handled after they have been reported to [email protected].
Issues that are brought to the attention of [email protected] are handled discretely. The issue will be verified and the author/maintainer of the affected code will usually be contacted. If the issue is indeed considered to be a problem the need for an immediate fix is assessed. The security team will notify also affected parties which are known to reuse the affected code.
If a fix is considered necessary, KDE release coordinators are contacted and KDE vendor packagers, Linux distributors and other prenotification mailing lists are informed once a fix is available that has passed review on [email protected]. We then give them a reasonable amount of time to prepare binary packages. After that time we issue a security alert via dot.kde.org, bugtraq and [email protected]. Patches in source form and any available updated binaries are published at the same time.
All security alerts are published on http://www.kde.org/info/security/.
KDE developers that want to join [email protected] can send a motivated request to [email protected]. Applications will be evaluated on a case by case basis by the current members. The main criteria is the extent to which someone can be helpful in executing the security policy as described here. That includes a willingness not to disclose issues prematurely.