Vulnerability Disclosure policy

[9:05 am] VASILESCU Alice (DIGIT-EXT)

DWOJAK Konrad (DIGIT-EXT) VASILESCU Alice (DIGIT-EXT) took a bit but it's finally here: Vulnerability Disclosure Policy . DIGIT S confirmed the projects on code.europa.eu can use the same policy good morning! DWOJAK Konrad (DIGIT-EXT), about the vulnerability disclosure policy, we have updated for LEOS and OOTS. I was thinking, what do you think about consolidating a table with the projects/groups and the contact details where the Vulnerability teams needs to redirect the findings, to save time and avoid any confusion

[9:05 am] VASILESCU Alice (DIGIT-EXT) and maybe also a personal contact person, like a Vulnerability champion, when available

added 2024 L2 OS Procedure Questions or Issue labels

assigned to @dwojako and @hillegi

Hi Alice. That's a great suggestion. Unfortunately, maintaining such a file for so many projects will create considerable overhead and I'm not sure the ROI would be enough, especially considering that for public projects, even a not signed in visitor can see the Members' list of a project. This means that the DIGIT S team working on the vulnerability report can see who are the owners and maintainers and can contact them. In case of questions, DIGIT OSPO can always assist and the DIGIT S team is aware to contact us for questions.

closed