On: Should gov.uk run a bug bounty?

[edent]

I'm not specifically talking about https://gov.uk/ but rather all of X.gov.uk - like HMRC, DWP, etc.

That said, is there a way on GitHub to privately raise a security related issue without the whole world seeing it?

[jpswade → edent]

Many of them are now open source too:

* http://government.github.com/community/

For example:

* https://github.com/hmrc

Sure it's not everything yet, but it's progress. You can still reach the right people and get involved.

[staticshock → edent]

Not for a public project... And github got rid of their private messaging system, suggesting that people email the package maintainers instead. So, the preferred route would probably be to do that. gov.uk could have an email address that functions as the front end to a private bug tracker.

[matthewcford → edent]

Not that I'm aware, they should probably have a disclosure email address/policy