[Spike] Investigate a security threat model for devfiles org

[thepetk]

Which area this user story is related to?

/area api
/area library
/area registry
/area alizer
/area landing-page

Issue description

As part of our security policy, recommended by the CLO Monitor best practices, we could implement a security threat model so we can understand better threats and mitigations within the devfiles org. A useful resource shared by cncf.io is https://www.cncf.io/blog/2023/03/16/threat-modeling-to-cloud-native-we-need-a-new-approach/.

This issue focuses only in the investigation around a potential security thread model which could be followed by the devfiles team.

Acceptance Criteria

• Decide if a threat model is a requirement for the devfiles org.
• If it is a requirement, the results of investigation have been shared.

[thepetk]

After going through the existing documentation over the threat model documents, I'm leaning towards not to continue with the threat model documentation for the CNCF tasks for the devfile org. It seems to me that this model can be applied better when the model is describing a tree for a whole system (e.g for a platform like openshift or maybe RHTAP).

My main thought is that the majority of the repos are services/tools used by other architectures/platforms etc and their use cases might not even be connected. So each case might need to have a different threat-model. For example we might need a different threat model for cases like odo and che as they are using different tools libraries/features inside the devfiles org.

That, said I think for now is better to focus on the Security.md side which will describe a process of how someone can report a vulnerability found for the devfiles org.

cc @michael-valdron @Jdubrick wdyt?

[thepetk]

Closing the investigation item, feel free to re-open if you think a threat-model is needed for the devfiles org.