Report security vulnerabilities using GitHub

[nicoddemus]

Direct users to report security vulnerabilities using GitHub's security advisory, which I just enabled in the repository.

[Pierre-Sassoulas]

👍 Did you also switch the tidelift config ? This can have financial consequences.

[nicoddemus]

Did you also switch the tidelift config ? This can have financial consequences.

Good call, there's probably a setting/link in there that should be updated. Shouldn't affect financials though, it was suggested in a email thread by their own support.

[nicoddemus]

More context: yesterday Tidelift reached out to me about a report, and one of the ways we could move the report forward was to enable the GitHub feature, which seems like a good idea as is easier for users and directly integrated into our workflow.

[Pierre-Sassoulas]

Previously the change would have happened here: https://tidelift.com/lifter/package/pypi/pytest/tasks/packages_have_security_policies (but it seems there's a new policy)

[nicoddemus]

Thanks for the link! We need a SECURITY.md file in the root too, added. I will update the Tidelift configuration after this lands on main (they need to make sure the SECURITY.md file is reachable from main).

[nicoddemus]

Tidelift updated:

(The key takeaway is Use my own process).