...
Named security contacts
Security issue reporting process (defined in SECURITY.md)
Security issue disclosure process - see task force https://github.com/hyperledger/toc/issues/48
Automated scans - linters, Software Composition Analysis dependency scans (e.g. Dependabot, Govulncheck), static analysis (SAST) scans (e.g. CodeQL, Snyk)
Keep dependencies up to date (e.g. Dependabot)
Major release security audits
OpenSSF secure developer guide - https://github.com/ossf/wg-best-practices-os-developers/blob/main/docs/Concise-Guide-for-Developing-More-Secure-Software.md
OpenSSF Best Practices Badge criteria - https://bestpractices.coreinfrastructure.org/en/criteria/0
Security Artifact Signing - proposed task force - https://github.com/hyperledger/toc/issues/49
...
User guide including Getting Started / Tutorial
Developer guide including coding guidelines, build instructions, test instructions
Application developer guide
- Recommended documentation platform
Releases
Release taxonomy - either SemVer or CalVer
Documented release strategy, release process, branch strategy
Long-term support (LTS) release strategy - example https://github.com/hyperledger/fabric-rfcs/blob/main/text/0005-lts-release-strategy.md
Release artifacts - attached to GitHub release, docker images in GitHub Packages versus Dockerhub
...