Define Minimum Set of Security Policies before OpenJS Onboarding

[RafaelGSS]

As we have discussed in the last security-collab-space meeting, establishing a minimum set of security policies for projects about to join the OpenJS Foundation would be interesting.

[RafaelGSS]

Security Policy

Reporting a Vulnerability

Please report security issues privately:

• Email: xxxx@xxx (or another private alias monitored by maintainers)
• Or use GitHub’s Report a vulnerability form on this repository (Security tab).

Do not file public GitHub issues for security problems.

When reporting, please include:

• Affected project/repo and version(s)
• Impact and component(s) involved
• Reproduction steps or PoC (if available)
• Your contact and preferred credit name

If you do not receive an acknowledgement within 6 business days, or cannot find a private contact, you may escalate to the OpenJS Foundation CNA at security@lists.openjsf.org. If a project does not respond within 14 days, escalation is appropriate.

Coordination & Disclosure

We follow coordinated vulnerability disclosure:

• We will acknowledge your report, assess impact, and work on a fix.
• We aim to provide status updates at reasonable intervals until resolution.
• We will publish a security advisory (and CVE via the OpenJS CNA when applicable) once a fix or mitigation is available. We credit reporters by default unless you request otherwise.

[bjohansebas]

I think we should allow at least 6–7 business days for a maintainer to respond initially, not everyone has the time to reply immediately. After that period, the report could be escalated to the CNA.

I know it’s just an example of the minimum time, and the maintainers will decide the actual timeframe.