Reporting security vulnerability

[Adam Dinwoodie]

On Thu, 25 Feb 2021 at 10:12, Evyatar Gerzi via Cygwin wrote:
> Hello,
>
> I saw that you have a mailing list for bug reporting but the bug that I
> found is a security vulnerability, to whom I need to report it?
> I don't know if it is good that it will be "read by many people", but it's
> your call.

Hi Evyatar,

Can you narrow down where the security vulnerability is? Different
parts of Cygwin have different maintainers – each package has its own
maintainer, as well as separate ownership of the core Cygwin DLL and
things like the Cygwin website – and I expect different maintainers
might prefer different approaches.


Adam