andrewmusselman opened a new issue, #670: URL: https://github.com/apache/tooling-trusted-releases/issues/670
**Audit refs:** 8.2.2 MEDIUM-006 #### Description `atr/tasks/message.py:44-55` — message sending allows any foundation committer to send to any `*.apache.org` mailing list address without verifying committee membership. A committer from Project A could send official-looking messages to Project B's mailing list. #### Recommended fix 1. Add prefixed comment 2. Add prefixed comment sensibility to prompt **CWE:** CWE-862 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
