Repository navigation
Security contact needed — SECURITY.md email has no MX, PVR not enabled #77
Description
Activity
Following up with something concrete rather than another ping, since both routes your policy names are currently closed:
SECURITY.mdsays to email security@piprapay.com. The domain has no MX record, so mail to it cannot be delivered:
$ dig +short MX piprapay.com # via 8.8.8.8, 1.1.1.1 and 9.9.9.9 (empty) $ dig +short TXT piprapay.com | grep -i spf (empty)With no MX, senders fall back to the A record, which is Cloudflare — not an SMTP host. So anyone following SECURITY.md today gets a bounce.
- GitHub private vulnerability reporting is not enabled on this repository:
POST /repos/PipraPay/PipraPay/security-advisories/reports 403 {"message": "Repository does not have private vulnerability reporting enabled"}Enabling PVR is one setting in Settings → Code security → Private vulnerability reporting, and it would give you a private channel that works without needing the mail domain fixed. If you turn it on, I will file there and close this issue.
Alternatively, point me at any address that receives mail and I will send it there. I have published nothing and am not going to.
Hi, I found several security vulnerabilities in PipraPay, including a critical payment-integrity issue, and would like to report them privately rather than in a public issue.
Your SECURITY.md lists security@piprapay.com, but that domain currently has no MX record (confirmed via multiple resolvers, 8.8.8.8/1.1.1.1/9.9.9.9 — no MX, no SPF/TXT record either), so mail sent there won't be deliverable. GitHub's private vulnerability reporting also isn't enabled on this repo (Security tab → "Report a vulnerability" returns "not enabled" via the API).
Could someone from the team either enable GitHub's private vulnerability reporting (Settings → Security → "Private vulnerability reporting") or point me to a working email/contact channel? Happy to send the full technical report as soon as there's a private channel to send it to.
Thanks,
kta1kri