From 5c5b4043ee26adc7b2fe47dc921b173e79ee9c6b Mon Sep 17 00:00:00 2001 From: RafaelGSS Date: Mon, 20 Jul 2026 17:22:29 -0300 Subject: [PATCH] doc: mention DEPENDENCY custom field for H1 reports Signed-off-by: RafaelGSS --- doc/contributing/security-release-process.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/doc/contributing/security-release-process.md b/doc/contributing/security-release-process.md index 84bd3ebe294406..4ddbe4be9ab50d 100644 --- a/doc/contributing/security-release-process.md +++ b/doc/contributing/security-release-process.md @@ -67,6 +67,8 @@ The current security stewards are documented in the main Node.js * [ ] 3\. **Assigning Severity and Writing Team Summary:** * [ ] Assign a severity and write a team summary on HackerOne for the reports chosen in the `vulnerabilities.json`. + * [ ] If a report targets a Node.js dependency, such as `undici` or `llhttp`, + make sure to update the `DEPENDENCY` custom field on HackerOne. * Run `git node security --sync` to update severity and summary in `vulnerabilities.json`.