all-for-one.yml

name: All for One, One For All bounty submission
description: Submit a CodeQL query for the All For One, One For All bounty (https://securitylab.github.com/bounties#allforone)
title: "[<language>]: <short description>"
labels: [All For One]
body:
  - type: markdown
    attributes:
      value: |
        # Introduction

        Thank you for submitting a query to the GitHub CodeQL project!

        After you submit this issue, the GitHub Security Lab and CodeQL teams will triage the submission and, if it meets the Query Bounty Program requirements, we will grant you a bounty through our HackerOne program.

        Please make sure to carefully read the [bounty program description and conditions](https://securitylab.github.com/bounties#allforone)

        # Questionnaire
  - type: input
    id: pr_url 
    attributes:
      label: Query PR
      description: Link to pull request with your CodeQL query
      placeholder: |
        ex. https://github.com/github/codeql/pull/nnnn
    validations:
      required: true
  - type: dropdown
    id: language
    attributes:
      label: Language
      description: What programming language is your query written for?
      options:
        - Java
        - Javascript
        - GoLang
        - Python
        - C/C++
        - C#
    validations:
      required: true
  - type: textarea
    id: cve_ids
    attributes:
      label: CVE(s) ID list
      description: Enter a list of the CVE ID(s) associated with this query, one bullet for each distinct CVE. GitHub will automatically link CVE IDs to the [GitHub Advisory Database](https://github.com/advisories). If the result(s) is **NOT YET** fixed **nor disclosed**, and you are still waiting for a CVE, then you can privately share your result via email to [security@github.com](mailto:security@github.com?subject=[BugBounty]%20Issue%20#000%20useful%20result)
      placeholder: |
        ex.
        - [CVE-20nn-xxxx](<relevant URL>)
        - [CVE-20nn-yyyy](<relevant URL>)
    validations:
      required: true
  - type: input
    id: cwe
    attributes:
      label: CWE
      description: "[CWE](https://cwe.mitre.org/data/index.html) that best fits the vulnerability class modeled with your query"
      placeholder: |
        ex. CWE-502: Deserialization of Untrusted Data
    validations:
      required: false
  - type: textarea
    id: report
    attributes:
      label: Report
      description: Describe the vulnerability. Provide any information you think will help GitHub assess the impact your query has on the open source community.
      placeholder: |
        1. What is the vulnerability?
        2. How does the vulnerability work?
        3. What strategy do you use in your query to find the vulnerability?
        4. How have you reduced the number of **false positives**?
        5. Other information?
    validations:
      required: true
  - type: checkboxes
    id: social 
    attributes:
      label: Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). 
      description: We would love to have you spread the word about the good work you are doing
      options:
        - label: "Yes"
        - label: "No" 
    validations:
      required: true
  - type: input
    id: social_url
    attributes:
      label: Blog post link
      description: If you have already blogged about your query, please provide a link.
    validations:
      required: false