...
- To address:
- Key contact points from each of the project.
- Check if the reported issue is a vulnerability/CVE.
- What if the reporter is from within the project.
- Follow up with maintainers, what happened to the issue that was raised?
- Do not use mailing list as it is functional today.
- Suggestions:
- Establish a process for reporting CVEs.
- Make use of GitHub CVE reporting feature to auto notify dependent projects.
- Survey while feeding in new issues ~ justify.
- Do calculate the score - questionnaire based report is not sufficient.
- Notify the third party (outside the project with familiarity of the reported issue). Consider reporter given their research motives.
- Use HackerOne as proposed in Gaps between guidance and implementation for CSVD - increase participation. Ask GB to sponsor.
- Process for auditing reported issues.
- In case of reporter is a member of the project team, create a checklist for members to follow to create a trace that provides auditability of what was done.
- Gap in OpenSSF
- Goal: provide feedback to OpenSSF so that their guidelines can be improved
Action items
- Checklist for members to follow while reporting vulnerabilities.
- Questionnaire to report vulnerability ~ calculate CVE score.
...