Finalize and Release CVD Resources v1.0

[ruddermann]

As part of OpenJS' grant from the German Sovereign Tech Fund (DE STF), we are going to leverage existing OpenSSF and other resources to develop and publish Coordinated Vulnerability Disclosure (CVD) resources for OpenJS Projects and Node.js Ecosystem Projects.

Guidance Sections

Preview Give feedback

1. Guide Section: Leveraging a Disclosure Platform #109
   guidance +1
   
2. Guide Section: Vulnerability Disclosure Policies #110
   0 of 2
   guidance security-agenda +2
   
3. Guide Section: Researcher Comms & Triage Processes #114
   guidance +1
4. Guide Section: Mitigation & Remediation Processes #115
   guidance +1
5. Guide Section: Release Comms & CVD Processes #138
   guidance +1
6. Guide Section: Issuing CVEs #111
   guidance +1
   
7. Guide Section: Disputing CVEs #116
   guidance +1
8. Guide Section: Dependencies and CVEs #112
   guidance +1

Templates

Preview Give feedback

1. Template: Researcher Triage and Update Comms #118
   template +1
2. Template: Release Communications #119
   template +1
3. Template: Minimal Vulnerability Disclosure Policy #107
   security-agenda template +2
   
4. Template: Recommended Vulnerability Disclosure Policy #108
   template +1
   

[ruddermann]

https://hackmd.io/abkuwmEuSuC-6qDS23FIsw

https://docs.google.com/document/d/1pFcaTyeTDtngnfdxhFgjZDhD_-dq9vB6UEdozAcO0sU/edit

[ruddermann]

https://hackmd.io/@rudd/H1R-3yrw0
https://hackmd.io/@rudd/rk4VsgBwC
https://hackmd.io/@rudd/Hym6PM8DC

[ruddermann]

These docs have been moved to the OpenJS GitHub: CVD_Guide