Update the security file in the repositories

[bjohansebas]

Currently, Express and its other two organizations have several repositories with a security file that is somewhat outdated since an email is now being used. We can update this file or remove it so that it takes the security file from .github

[UlisesGascon]

Yep! Great idea do you want to work on it? I am happy to do it as well

[bjohansebas]

Did we delete the file, or did we just update it?

[UlisesGascon]

Ideally we delete it, so we inherit the content directly from the .github repo in each org

[bjohansebas]

Great, I can do it

[bjohansebas]

I've made a script to make the process less manual. These are the repositories that have that file.

Repository that contains the SECURITY.md file:

pillarjs/send
pillarjs/path-to-regexp
pillarjs/finalhandler
pillarjs/router
pillarjs/encodeurl
jshttp/cookie
jshttp/forwarded
expressjs/body-parser
expressjs/serve-static

[ljharb]

Be sure to check both for SECURITY.md and .github/SECURITY.md, case-insensitive.

[bjohansebas]

path-to-regexp and encodeurl have a different security file, they use Tidelift to report vulnerabilities. What should we do there?

[UlisesGascon]

path-to-regexp and encodeurl have a different security file, they use Tidelift to report vulnerabilities. What should we do there?

As far I know this is an outdated policy and we can remove it, but it will require an update in Tidelift side too (cc: @expressjs/express-tc )

[UlisesGascon]

So far we merged all the pending PRs:

• docs: remove security file body-parser#590
• docs: remove security file serve-static#195
• docs: remove security file pillarjs/send#248
• docs: remove security file pillarjs/finalhandler#83
• docs: remove security file pillarjs/router#152
• docs: remove security file jshttp/cookie#218
• docs: remove security file jshttp/forwarded#17
• docs: remove security file pillarjs/path-to-regexp#351
• docs: remove security file pillarjs/encodeurl#10

@blakeembrey can you update Tidelift too (ref)?

At this stage we can consider the activity completed, so I close the issue now 👍