Add 'duplicate' triage action (#57) * Add 'duplicate' triage action Adds a third triage decision alongside accept/reject: the PMC can mark a report as a duplicate of an already-tracked report, with a free-text field for the CVE id or reference. Reuses the existing /triage/accept endpoint, with the reference prepended to the notification email's response text. Selecting the original report from a list, and allowing PMCs to reject duplicate reporters individually, are left as possible follow-ups per discussion on the issue. Fixes apache/security-dash#51 * Move the duplicate reference into the email preview The CVE/reference input now sits inline inside the preview sentence instead of as a separate field above it, so what the PMC sees in the preview is exactly what gets sent -- no separate copy to keep in sync. Addresses review feedback from @raboof. * some fixes after testing --------- Co-authored-by: Arnout Engelen <arnout@bzzt.net>
A dashboard over the security issues reported to the Apache Software Foundation, so that every PMC can see what is still on its plate.
The project page lists the open cases of a project, grouped by the state they are in — untriaged, confirmed, waiting for disclosure, and the various kinds of non-issue — each with a short note on what the PMC is expected to do next. The statistics page charts the debt of a project over the past two years: the sum, over the issues open at that moment, of the days since each was reported, plus a constant per issue.
Signing in uses ASF OAuth. A user sees the projects of the PMCs they belong to; members of the security team see every project.
The dashboard needs uv and a copy of the issue data. Copy config.yaml.example to config.yaml and point data_dir at that data — see docs/ for the format it is expected to be in.
uv run python server.py # development: auto-reload and debug uv run hypercorn server:application # production
uv run --with pytest pytest
docs/ — the format of the issue data that backs the dashboard.Apache License, Version 2.0.