From b4d92b73f8737cdc28406f74fe4dd258b27c619a Mon Sep 17 00:00:00 2001 From: Ulises Gascon Date: Mon, 4 Mar 2024 18:44:51 +0100 Subject: [PATCH 01/10] docs: add working group details --- README.md | 65 +++++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 63 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 58dc485..1b58c82 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,63 @@ -# security-wg -Express.js Security Working Group +# Security Working Group + +## Charter + +The Security Working Group manages all aspects and processes linked to Express.js security, and is responsible for managing incoming security reports, and responsible also to prepare patches or releases. The nature of this task is sensitive, so only the Security triage team, Repo Captains and TC members will be involved on it. + +**Responsibilities include** +- Define the Security triage role +- Define and maintain security policies and procedures for the project and the packages in scope +- Elaborate guidelines and recommendations for the ecosystem on how to build more secure middleware +- Review and recommend processes for handling of security reports. +- Promote improvement of security practices within the Express.js ecosystem (For example: [OSSF Scorecard](https://github.com/expressjs/discussions/issues/162), threat model, etc..) +- Recommend security improvements for the project and the packages in scope +- Support the TC team on security triage when is requested +- Support initiatives from the [OpenJS Foundation Security Collab Space](https://github.com/openjs-foundation/security-collab-space). + + +## Current Initiatives + +We are currently defining the Initiatives for 2024, [feel free to participate](https://github.com/expressjs/security-wg/issues/1). + +| Initiative | Champion | Status | Links | +|------------|----------|--------|-------| +| OSSF Scorecard | [@inigomarquinez](https://github.com/inigomarquinez) | In progress | [#2](https://github.com/expressjs/security-wg/issues/2)| +| Threat Model | _TBC_ | In progress | [#3](https://github.com/expressjs/security-wg/issues/3) | +| Support OSTIF Audit | [@UlisesGascon](https://github.com/ulisesgascon) | In progress | [#6](https://github.com/expressjs/security-wg/issues/6) + +## Members + +The Security Working Group is composed by two groups of members: the Security Triage Team and the Regular members. The regular members are responsible for the public facing activity of the group, while the Security Triage Team is responsible for the security triage process. + +### Security Triage Team + +- [Adam Ruddermann](https://github.com/ruddermann) +- [Chris de Almeida](https://github.com/ctcpip) +- [Jean Burellier](https://github.com/sheplu) +- [Marco Ippolito](https://github.com/marco-ippolito) +- [Rafael Gonzaga](https://github.com/RafaelGSS) +- [Ulises Gascón](https://github.com/UlisesGascon) +- [Wes Todd](https://github.com/wesleytodd) + +### Team Members +- [Adam Ruddermann](https://github.com/ruddermann) +- [Carlos Serrano](https://github.com/carpasse) +- [Chris de Almeida](https://github.com/ctcpip) +- [Íñigo Marquínez Prado](https://github.com/inigomarquinez) +- [Jean Burellier](https://github.com/sheplu) +- [Marco Ippolito](https://github.com/marco-ippolito) +- [Rafael Gonzaga](https://github.com/RafaelGSS) +- [Ulises Gascón](https://github.com/UlisesGascon) +- [Wes Todd](https://github.com/wesleytodd) + +## Meetings + +The Security Working Group meets every two weeks. Meetings are held on Zoom and are recorded or directly streamed to Youtube. The meeting is open to the public. The agenda and meeting notes are published in this repository. + +## Offline Discussions + +The Security Working Group uses the [GitHub issues](https://github.com/expressjs/security-wg/issues) for offline discussions. The discussions are open to the public and anyone can participate. Also, the group uses the channel `#express-security-wg` in the [OpenJS Foundation Slack](https://openjsf.org/collaboration) for real-time discussions. + +## Code of Conduct + +The [Express.js CoC](https://github.com/expressjs/express/blob/master/Code-Of-Conduct.md) applies to this repo. \ No newline at end of file From 4056b84f7a63716f296e6b0816811e1482fa92c4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Thu, 7 Mar 2024 20:44:30 +0100 Subject: [PATCH 02/10] docs: improve readability Co-authored-by: Chris de Almeida --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 1b58c82..fb49f4b 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ We are currently defining the Initiatives for 2024, [feel free to participate](h ## Members -The Security Working Group is composed by two groups of members: the Security Triage Team and the Regular members. The regular members are responsible for the public facing activity of the group, while the Security Triage Team is responsible for the security triage process. +The Security Working Group is composed of two groups of members: the Security Triage Team and the Regular members. The regular members are responsible for the public facing activity of the group, while the Security Triage Team is responsible for the security triage process. ### Security Triage Team From 7245543a4536bb47dcb946a24a50bfe7924e056a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Thu, 7 Mar 2024 20:47:15 +0100 Subject: [PATCH 03/10] docs: add support for OSSF Best practices initiative Co-authored-by: Chris de Almeida --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index fb49f4b..ee4684f 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ The Security Working Group manages all aspects and processes linked to Express.j - Recommend security improvements for the project and the packages in scope - Support the TC team on security triage when is requested - Support initiatives from the [OpenJS Foundation Security Collab Space](https://github.com/openjs-foundation/security-collab-space). - +- Support initiatives from the OpenSSF [Best Practices for Open Source Developers Working Group](https://github.com/ossf/wg-best-practices-os-developers). ## Current Initiatives From dffab003e9ad45653df833eaa742c9e256664952 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Thu, 7 Mar 2024 20:49:30 +0100 Subject: [PATCH 04/10] docs: improve readability Co-authored-by: Chris de Almeida --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index ee4684f..08924bb 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ The Security Working Group manages all aspects and processes linked to Express.j - Review and recommend processes for handling of security reports. - Promote improvement of security practices within the Express.js ecosystem (For example: [OSSF Scorecard](https://github.com/expressjs/discussions/issues/162), threat model, etc..) - Recommend security improvements for the project and the packages in scope -- Support the TC team on security triage when is requested +- Support the TC team on security triage as needed - Support initiatives from the [OpenJS Foundation Security Collab Space](https://github.com/openjs-foundation/security-collab-space). - Support initiatives from the OpenSSF [Best Practices for Open Source Developers Working Group](https://github.com/ossf/wg-best-practices-os-developers). From cbb9880f016acf8a6e55b81f0157c52c8bdea564 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Thu, 7 Mar 2024 20:49:40 +0100 Subject: [PATCH 05/10] docs: improve readability Co-authored-by: Chris de Almeida --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 08924bb..8569aa1 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ The Security Working Group manages all aspects and processes linked to Express.j **Responsibilities include** - Define the Security triage role - Define and maintain security policies and procedures for the project and the packages in scope -- Elaborate guidelines and recommendations for the ecosystem on how to build more secure middleware +- Provide guidance to the ecosystem on how to build more secure middleware - Review and recommend processes for handling of security reports. - Promote improvement of security practices within the Express.js ecosystem (For example: [OSSF Scorecard](https://github.com/expressjs/discussions/issues/162), threat model, etc..) - Recommend security improvements for the project and the packages in scope From 3b82f3a93cf413aad96466a4fffe83e2b6b3d3f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Thu, 7 Mar 2024 20:49:51 +0100 Subject: [PATCH 06/10] docs: improve readability Co-authored-by: Chris de Almeida --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 8569aa1..1fcae8c 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,8 @@ The Security Working Group manages all aspects and processes linked to Express.js security, and is responsible for managing incoming security reports, and responsible also to prepare patches or releases. The nature of this task is sensitive, so only the Security triage team, Repo Captains and TC members will be involved on it. -**Responsibilities include** +### Responsibilities + - Define the Security triage role - Define and maintain security policies and procedures for the project and the packages in scope - Provide guidance to the ecosystem on how to build more secure middleware From e66278822397d918f4af191cde0db54f182b97ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Thu, 7 Mar 2024 20:49:59 +0100 Subject: [PATCH 07/10] docs: improve readability Co-authored-by: Chris de Almeida --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 1fcae8c..43a52cf 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ ## Charter -The Security Working Group manages all aspects and processes linked to Express.js security, and is responsible for managing incoming security reports, and responsible also to prepare patches or releases. The nature of this task is sensitive, so only the Security triage team, Repo Captains and TC members will be involved on it. +The Security Working Group manages all aspects and processes linked to Express.js security, and is responsible for managing incoming security reports, and responsible also to prepare patches or releases. The nature of this task is sensitive, so only the Security triage team, Repo Captains and TC members will be involved in it. ### Responsibilities From d1c993b12263c66f0674d8f020dc6c918dfbb88b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Sun, 10 Mar 2024 17:34:37 +0100 Subject: [PATCH 08/10] docs: add calendar reference --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 43a52cf..c1f7c20 100644 --- a/README.md +++ b/README.md @@ -53,7 +53,7 @@ The Security Working Group is composed of two groups of members: the Security Tr ## Meetings -The Security Working Group meets every two weeks. Meetings are held on Zoom and are recorded or directly streamed to Youtube. The meeting is open to the public. The agenda and meeting notes are published in this repository. +The Security Working Group meets every two weeks. Meetings are held on Zoom and are recorded or directly streamed to Youtube. The meeting is open to the public. The agenda and meeting notes are published in this repository. The calendar entries are available in the [OpenJS Foundation calendar](https://openjsf.org/collaboration). ## Offline Discussions From 317ff29dbb6a00c815bce0c43f24d0954c442ef8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Sun, 10 Mar 2024 17:36:49 +0100 Subject: [PATCH 09/10] docs: update references to Express.js project --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index c1f7c20..6b2fe96 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ ## Charter -The Security Working Group manages all aspects and processes linked to Express.js security, and is responsible for managing incoming security reports, and responsible also to prepare patches or releases. The nature of this task is sensitive, so only the Security triage team, Repo Captains and TC members will be involved in it. +The Security Working Group manages all aspects and processes linked to the Express Project's security, and is responsible for managing incoming security reports, and responsible also to prepare patches or releases. The nature of this task is sensitive, so only the Security triage team, Repo Captains and TC members will be involved in it. ### Responsibilities @@ -10,7 +10,7 @@ The Security Working Group manages all aspects and processes linked to Express.j - Define and maintain security policies and procedures for the project and the packages in scope - Provide guidance to the ecosystem on how to build more secure middleware - Review and recommend processes for handling of security reports. -- Promote improvement of security practices within the Express.js ecosystem (For example: [OSSF Scorecard](https://github.com/expressjs/discussions/issues/162), threat model, etc..) +- Promote improvement of security practices within the Express project's ecosystem (For example: [OSSF Scorecard](https://github.com/expressjs/discussions/issues/162), threat model, etc..) - Recommend security improvements for the project and the packages in scope - Support the TC team on security triage as needed - Support initiatives from the [OpenJS Foundation Security Collab Space](https://github.com/openjs-foundation/security-collab-space). @@ -61,4 +61,4 @@ The Security Working Group uses the [GitHub issues](https://github.com/expressjs ## Code of Conduct -The [Express.js CoC](https://github.com/expressjs/express/blob/master/Code-Of-Conduct.md) applies to this repo. \ No newline at end of file +The [Express Project's CoC](https://github.com/expressjs/express/blob/master/Code-Of-Conduct.md) applies to this repo. \ No newline at end of file From 83125231cd210f79b9603961969eb93baaf0cfc8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ulises=20Gasc=C3=B3n?= Date: Sun, 10 Mar 2024 17:41:11 +0100 Subject: [PATCH 10/10] docs: add reference to projects spreadsheet --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 6b2fe96..9056c5a 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ The Security Working Group manages all aspects and processes linked to the Expre ### Responsibilities - Define the Security triage role -- Define and maintain security policies and procedures for the project and the packages in scope +- Define and maintain security policies and procedures for the project and the packages in scope (see [this spreadsheet for scope details](https://docs.google.com/spreadsheets/d/1Qi7B78K6R_RyFloAcrcizL2oYawwMEmdKjgzC_Lik9Q/edit#gid=475621832)) - Provide guidance to the ecosystem on how to build more secure middleware - Review and recommend processes for handling of security reports. - Promote improvement of security practices within the Express project's ecosystem (For example: [OSSF Scorecard](https://github.com/expressjs/discussions/issues/162), threat model, etc..)