Unable to report security vulnerabilities via the mailing list

[KrisKennawayDD]

Hello, I'm attempting to report several security vulnerabilities. The project README instructs to:

If there is a security concern with one of the CloudEvents specifications, or with one of the project's SDKs, please send an email to cncf-cloudevents-security@lists.cncf.io.

However this email address bounced because I'm not a member:

510 5.1.1 Your email address, REDACTED, is not subscribed to that group. To subscribe, send an email to cncf-cloudevents-security+subscribe@lists.cncf.io, or visit https://lists.cncf.io/g/cncf-cloudevents-security

The mailing list isn't listed at https://lists.cncf.io/g/cncf-cloudevents-security (likely because it's private or does not exist)

Please could you fix this mailing list configuration to allow non-member posting, or provide an alternate contact mechanism?

[duglin]

@KrisKennawayDD hmmm let me look into that..... thanks for letting me know

[duglin]

@KrisKennawayDD please try to send a test message now - I'd like to see if 1) it gets bounced, and 2) if it remains private

[KrisKennawayDD]

Thanks! I've re-sent.

[duglin]

Apparently it might take a little bit of time for the new mailing list to be active. If your anxious you can ping me on cncf slack ( id: dug) - or wait... up to you

[duglin]

@KrisKennawayDD sorry for the delay - please try again, I think it's fixed now

[KrisKennawayDD]

Thank you, I have re-sent the email.

[duglin]

got it!! Thanks - let me review it with the appropriate folks...