...
Mailing lists - perhaps one targeted for users and another targeted for contributors/maintainers?
Discord Chat - important to strike a balance between too few and too many chat channels
Public meetings - regular cadence
Pull Requests - quick review turnarounds are appreciated
Contributing docs - examples:
- NOTE - Perhaps common "contributing" content can be aggregated so that each project doesn't re-invent.
Security - add link to security see also 2022 security task force
Named security contacts per project (at least two)
Security issue reporting process defined in SECURITY.md with reference to Hyperledger reporting process
Security issue disclosure process - see task force https://github.com/hyperledger/toc/issues/48 Disclosure task force
Leverage automated scans
linters
Software Composition Analysis dependency scans, e.g. Dependabot, Govulncheck (depends on language)
Static Application Security Testing (SAST) aka static analysis scans, e.g. CodeQL, Snyk
Keep dependencies up to date (e.g. Dependabot)
Security audits for Graduated project major releases
Review and obtain OpenSSF Best Practices Badge - criteria
Security Artifact Signing - proposed task force - https://github.com/hyperledger/toc/issues/49
Documentation - add link to Documentation see also Documentation task force and Onboarding task forces
User guide including Getting Started / Tutorial
Developer guide including coding guidelines, build instructions, test instructions
Application developer guide
- Recommended documentation platform?
...