Security Contact Email to Validator Descrition

[rigelrozanski]

Summary

Problem Definition

Proposal

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned

[AdityaSripal]

why would this need to be stored in appstate? could just be on validator's website

[jessysaurusrex]

@AdityaSripal As part of our incident retrospective from May, we realized that we needed a direct line of communication with validators for coordination, and a way to gather reliable contact information to quickly coordinate response to security incidents that impact the Cosmos hub and our network operators.

Given that we'd like to be able to pre-notify validators that they should be ready to patch when a fix for a high or critical severity issue surfaces, it's simpler for us to query for a parameter on the network when needed versus dig through ~100+ different websites or try to require us to maintain a spreadsheet of ever-changing contact info. Plus, by filling out the field, we have a clear sign from our network operators that serves as an opt-in to vulnerability coordination with a security@[validator.domain] email address.

[AdityaSripal]

ok thanks for the explanation 👍