diff --git a/doc/contributing/security-release-process.md b/doc/contributing/security-release-process.md index 5a161a0f060b1c..25f61c2ac1d4c7 100644 --- a/doc/contributing/security-release-process.md +++ b/doc/contributing/security-release-process.md @@ -118,6 +118,7 @@ out a better way, forward the email you receive to `oss-security@lists.openwall.com` as a CC. * [ ] Create a new issue in [nodejs/tweet][] + ```text Security release pre-alert: @@ -130,6 +131,13 @@ out a better way, forward the email you receive to https://nodejs.org/en/blog/vulnerability/month-year-security-releases/ ``` + We specifically ask that collaborators other than the releasers and security + steward working on the security release do not tweet or publicise the release + until the tweet from the Node.js twitter handle goes out. We have often + seen tweets sent out before the release and associated announcements are + complete which may confuse those waiting for the release and also takes + away from the work the releasers have put into shipping the releases. + * [ ] Request releaser(s) to start integrating the PRs to be released. * [ ] Notify [docker-node][] of upcoming security release date: _**LINK**_