...
Named security contacts
Security issue reporting process (defined in SECURITY.md)
Security issue disclosure process - see task force https://github.com/hyperledger/toc/issues/48
Automated scans -
linters
Software Composition Analysis dependency
scans (e.g.
Dependabot, Govulncheck)
Static Application Security Testing (SAST) aka static analysis scans (e.g. CodeQL, Snyk)
Keep dependencies up to date (e.g. Dependabot)
Major release security audits
OpenSSF secure developer guide - https://github.com/ossf/wg-best-practices-os-developers/blob/main/docs/Concise-Guide-for-Developing-More-Secure-Software.md
OpenSSF Best Practices Badge criteria - https://bestpractices.coreinfrastructure.org/en/criteria/0
Security Artifact Signing - proposed task force - https://github.com/hyperledger/toc/issues/49
...