Repository navigation
Validate process to report security issues #37
Description
Activity
- added a parent issue
on Jul 2, 2026 bootc meets both CNCF security documentation requirements:
1. Clearly defined and discoverable process to report security issues:
- SECURITY.md provides step-by-step instructions for GitHub Security Advisories
- Clear guidance on what NOT to do (no public disclosure)
- Root-level location (discoverable)
- Reference: https://github.com/bootc-dev/bootc/blob/main/SECURITY.md
2. Document assignment of security response roles and how reports are handled:
- GOVERNANCE.md defines Security Response Team
- Appointment process: Maintainers appoint minimum 2 contributors
- Annual review requirement
- Clear responsibility: "handle all reports according to security policy"
- Reference: https://github.com/bootc-dev/bootc/blob/main/GOVERNANCE.md#security-response-team
Comparison with CNCF Graduated Projects:
- Uses same reporting method as containerd (GitHub Security Advisories)
- Better cross-referencing than Kubernetes (external docs) or containerd (separate repo)
- Appropriate depth for incubation stage
Both requirements fully met. ✅
Should be a link to a section in the security docs, iirc.