Create SECURITY.md #1039
Merged
Create SECURITY.md #1039
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
@dongsupark Please describe the security process we do weekly
dongsupark
reviewed
May 24, 2023
|
Marking as ready for review, which the PR should be after the suggestions are merged. |
Co-authored-by: Dongsu Park <[email protected]>
Co-authored-by: Dongsu Park <[email protected]>
Co-authored-by: Dongsu Park <[email protected]>
Co-authored-by: Thilo Fromm <[email protected]>
Co-authored-by: Thilo Fromm <[email protected]>
dongsupark
reviewed
Jun 8, 2023
SECURITY.md
Outdated
| ## Daily security runbook for Security team primaries and secondaries | ||
|
|
||
| The runbook below discusses steps for identifying new potential security issues and for making the issues known to the Flatcar project's maintainers and / or the other members of the Security team. | ||
| Embargoed issues are recorded in a private issue tracker only accessible by the Security team, while public issues are openly tracked in the [Flatcar project](https://github.com/Flatcar/Flatcar/issues). |
There was a problem hiding this comment.
This line is duplicate of the 11-12nd line above. Let's simply remove it.
t-lo
reviewed
Jun 8, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Primary person should do so:
Every day look into upstream security trackers like below:
gorss+ RSS feed for this.Whenever we discover any new CVE, we add it to an internal database, and use automation tools to create a new issue about the CVE in Flatcar GitHub issues with labels
securityandadvisory.If an issue of updating the specific package affected by the new CVE is already open in Flatcar GitHub issues, then unfortunately we need to manually edit the existing issue to add the new CVE.