Found a security issue with RubyGems or RubyGems.org? Please follow these steps to report it.
Reporting a security issue
Before continuing, please ensure this is a security issue for the RubyGems client or the RubyGems.org service. For all vulnerabilities with individual gems, follow our guide on reporting security issues with others' gems. If it's a security issue with the Ruby on Rails framework, see the Rails Security guide.
For any security bug or issue with the RubyGems client or RubyGems.org service, please email security@rubygems.org with details about the problem or submit a report using HackerOne. RubyGems no longer offers monetary rewards for bug bounty reports.
If you find a compromised or malicious gem, please consider it as a security issue: please email security@rubygems.org with the gem name or submit a report using HackerOne.
Please note: the rubygems-developers mailing list, the rubygems.org mailing list, and the #rubygems IRC channel are public areas. If escalating to these places, please do not discuss your issue, simply say that you’re trying to get a hold of someone from the security team. Thanks in advance for responsibly disclosing your security issue.
Gem Security Outreach
Sometimes the contact goes the other way. If our security team confirms a vulnerability in a gem you maintain, or receives a report about one, we will contact you privately before anything is made public. If we need to reach out to you about a gem security issue, we will use gem-security@rubygems.org. We will never ask you for a password, an API key, or any other credential.
Mail from that address is
DKIM signed under rubygems.org, so your mail provider can
verify that a message really came from us. If something claiming to be from
the team fails that check, or simply feels off, don’t act on the message
itself — email us separately and ask.
Where a conversation calls for encrypted or signed email, we use the GPG
key for gem-security@rubygems.org, with the fingerprint
1595 58E3 5BCC F820 A48D DB7C D170 F9A9 E4FB 3D7A. Please encrypt anything
sensitive, such as proof-of-concept code, to that key, and check the
fingerprint matches the above before you trust it. The full public key is published in
our security team’s FAQ.
Reporting RubyGems.org Website Problems
If you're having trouble pushing a gem, or otherwise need help with your RubyGems.org account, please open a new help issue.
For bugs or other problems with RubyGems.org, please use the RubyGems.org issue tracker to open a new issue.
Disclosure Policy
RubyGems and RubyGems.org follow a 5 step disclosure policy:
- Security report received and is assigned a primary handler. This person will coordinate the fix and release process.
- Problem is confirmed and, a list of all affected versions is determined. Code is audited to find any potential similar problems.
- Fixes are prepared for all releases which are still supported. These fixes are not committed to the public repository but rather held locally pending the announcement.
- A suggested embargo date for this vulnerability is chosen.
- On the embargo date, the rubygems-developers mailing list is sent an announcement. This will include patches for all versions still under support. The changes are pushed to the public repository and new gems released to rubygems. At least 6 hours after the mailing list is notified, a copy of the advisory will be published on the RubyGems.org blog.
This process can take some time, especially when coordination is required with maintainers of other projects. Every effort will be made to handle the bug in as timely a manner as possible, however it’s important that we follow the release process above to ensure that the disclosure is handled in a consistent manner.
Receiving Security Updates
The best way to receive all the security announcements is to subscribe to the rubygems-developers mailing list.
No one outside the core team or the initial reporter will be notified prior to the lifting of the embargo. We regret that we cannot make exceptions to this policy for high traffic or important sites, as any disclosure beyond the minimum required to coordinate a fix could cause an early leak of the vulnerability.
Comments on this Policy
If you have any suggestions to improve this policy, please send an email to security@rubygems.org or open an issue on GitHub. Thanks!