--- REDACTED ---

[charleskoehl]

--- REDACTED ---

[milesrichardson]

Confirmed, I can reproduce this.

I also tested it on an empty class and a class with objects in it. The bug happens in both cases.

-- REDACTED --

[flovilmart]

Can you provide the server logs when running with VERBOSE=1?

[flovilmart]

I believe I found the root cause, and will provide a fix in the next hour

[flovilmart]

@charleskoehl I'm gonna close this issue now.

I want to take a minute to let you know that issues that may affect security should be privately reported. As mentioned by @milesrichardson everyone now knows the issue, and is able to target the servers.

[flovilmart]

I've cleaned up the conversation, unfortunately github keeps a tail of events with the changes.

[milesrichardson]

fwiw I can only see that you deleted the comment, can't see the old contents. Maybe you can because you're admin

[charleskoehl]

I'm very sorry for that; I'm sort of a noob in the open source community despite having coded since 1982.

[flovilmart]

No worry @charleskoehl, mistakes happen. That made me realize we don't have a security 'hotline' / email.

[nbering]

I'm just curious... is there a published confidential disclosure procedure? An email address? Maybe a PGP key?

[flovilmart]

We should put that in place sooner than later. I’ll do it before Monday, with a public pgp key!

[montymxb]

We should also add a notice for responsible disclosures in the the issue/PR template.

[flovilmart]

Yes, in the issue template, .org domains, and all README’s

[charleskoehl]

Perhaps this could help clean things up more:

https://help.github.com/articles/locking-conversations/