Skip to content

Split OSPS-VM-01.01 into two requirements #555

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Satarupa22-SD wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Split OSPS-VM-01.01 into two requirements #555

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 20 additions & 3 deletions baseline/OSPS-VM.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,15 @@ controls:
assessment-requirements:
- id: OSPS-VM-01.01
text: |
The project documentation MUST
include a policy for coordinated vulnerability disclosure (CVD), with a clear
timeframe for response.
Retired in https://github.com/ossf/security-baseline/pull/555
applicability:
- maturity-2
- maturity-3
state: Retired
- id: OSPS-VM-01.02
text: |
The project documentation MUST include a coordinated
vulnerability disclosure (CVD) policy.
Comment on lines +23 to +31

@eddie-knight eddie-knight Sep 4, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can get behind Ben's idea here... We are loosening this slightly, but not changing the meaning. Adding strictness or changing meaning would demand a retirement.

Suggested change
Retired in https://github.com/ossf/security-baseline/pull/555
applicability:
- maturity-2
- maturity-3
state: Retired
- id: OSPS-VM-01.02
text: |
The project documentation MUST include a coordinated
vulnerability disclosure (CVD) policy.
The project documentation MUST include a coordinated
vulnerability disclosure (CVD) policy.

applicability:
- maturity-2
- maturity-3
Expand All @@ -31,6 +37,17 @@ controls:
project's policy for coordinated vulnerability disclosure. Include a
method for reporting vulnerabilities. Set expectations for how the
project will respond and address reported issues.
- id: OSPS-VM-01.03
text: |
The project's coordinated vulnerability disclosure (CVD) policy
MUST define a timeframe for responding to vulnerability reports.
applicability:
- maturity-2
- maturity-3
recommendation: |
Create a SECURITY.md file at the root of the directory, outlining the
project's policy for coordinated vulnerability disclosure. The file
should define a timeframe for responding to vulnerability reports.

- id: OSPS-VM-02
title: |
Expand Down
Loading