Write first draft of responsible security reporting guidelines for OpenJS Foundation

[mhdawson]

Based on openjs-foundation/cross-project-council#326 we are looking for a volunteer to write the first version of the security reporting guidelines, following the https://github.com/openjs-foundation/cross-project-council/blob/master/STAGING_PROCESS.md to make the proposal.

Ideally the work would be:

1. review the reporting procedures (or gap) for existing member projects
2. Propose a first draft of guidelines that would apply for member projects. It might be different based on level of project (For example may be required for Impact project, optional for add-hoc)
3. Consider and recommend whether the OpenJS foundation should offer support in satisfying the guidelines

[mhdawson]

@nodejs/security-wg any volunteers?

[MarcinHoppe]

I could devote some time for it starting next week, I think this is in line with what I wanted to propose for nodejs/package-maintenance#159.

[mhdawson]

@MarcinHoppe thanks !

[mhdawson]

@MarcinHoppe I'm wondering if you think you'll still have time to get to this.

[MarcinHoppe]

Thanks for a reminder! I actually have a draft that I need to put in a PR and start the discussion. I will do my best to wrap it up by the end of this week.

[SomeoneWeird]

Very keen on helping with this one - let me know if you want any help @MarcinHoppe

[MarcinHoppe]

@SomeoneWeird amazing! I should have a PR up soon.

[MarcinHoppe]

@mhdawson @SomeoneWeird I put together a draft PR under the Package Maintenance WG and I'd love to know if you think we could re-use this somehow for the OpenJS Foundation guidelines?

The PR is: nodejs/package-maintenance#277.

[mhdawson]

@MarcinHoppe I think that is a good baseline. What I think we'd want to do for the OpenJS Foundation guidelines (ie scope of this issue) is to narrow down the choices to what we'd want to recommend for OpenJS projects (although maybe with options based on at-large, impact etc if that makes sense) and provide a recommend template for the policy itself.

[MarcinHoppe]

Makes sense, thanks for clarification. Honestly I'd prefer for the discussion in Node.js Package Maintenance WG to take place first, and then we can extract guidance that we arrive at there (hopefully soon-ish) and apply it to OpenJS Foundation projects.

Does it sound like an acceptable course of action, or do you want to move faster with this issue?

[mhdawson]

@MarcinHoppe sounds good to me.

[MarcinHoppe]

@mhdawson I feel that nodejs/package-maintenance#277 is close to landing. Would now be an appropriate time to engage with the OpenJS Foundation to draft the security reporting guidelines?

[mhdawson]

@MarcinHoppe yes, I had commented on #277 since it landed. Are you able to take a first cut or do you think we need to gather info/feedback first?