Repository navigation

docs: add security guidelines and SECURITY.md template - #7

Merged

jakobmoellerdev merged 27 commits into

neonephos:mainfrom

morri-son:add-security-docs

Sep 14, 2026

Merged

docs: add security guidelines and SECURITY.md template#7
jakobmoellerdev merged 27 commits into
neonephos:mainfrom
morri-son:add-security-docs

Commits on Sep 14, 2026
- docs: add security guidelines and SECURITY.md template
  
  morri-son
  authored and
  morrison-sap
  committed
  0805c5c
- docs: improve practicality of security docs — make guidelines livable
  
  morri-son
  authored and
  morrison-sap
  committed
  52f0301
- docs: relax supply chain resolution timelines to match project maturity
  
  morri-son
  authored and
  morrison-sap
  committed
  1c43656
- docs: integrate PR feedback — add operational security controls, OpenSSF Scorecard, and template improvements
  
  morri-son
  authored and
  morrison-sap
  committed
  126fc35
- docs: make vulnerability reporting platform-agnostic
  
  morri-son
  authored and
  morrison-sap
  committed
  26a288d
- docs: add container image scanning and license compliance scanning sections
  
  morri-son
  authored and
  morrison-sap
  committed
  b1df220
- docs: align security guidelines with OpenSSF Security Baseline
  
  morri-son
  authored and
  morrison-sap
  committed
  d500aa6
- docs: trim implementation details, add SLA rationale and exemplary project references
  
  morri-son
  authored and
  morrison-sap
  committed
  e17382b
- consolidate section 8, Revise introduction statement and point to OpenSSF
  
  morri-son
  authored and
  morrison-sap
  committed
  fed9e42
- add link to openssf Vulnerability Disclosure Guide
  
  morri-son
  authored and
  morrison-sap
  committed
  10fd2e2
- soften SLAs
  
  morri-son
  authored and
  morrison-sap
  committed
  2c8fe3e
- docs: condense security guidelines from 513 to 300 lines
  
  morri-son
  authored and
  morrison-sap
  committed
  d9ad1a6
- address PR review feedback from Skarlso
  
  morri-son
  authored and
  morrison-sap
  committed
  738d748
- make push protection a MUST
  
  morri-son
  authored and
  morrison-sap
  committed
  cd778f9
- Update security-guidelines/security-guidelines.md
  
  authored and
  morrison-sap
  committed
  0a7cb71
- docs: clarify security guidelines scope is dev/build/release lifecycle
  morrison-sap
  committed
  17cd17e
- docs: spell out CVSS judgment criteria in §7
  morrison-sap
  committed
  586951f
- docs: tie SCA scan frequency and visibility to OpenSSF Baseline
  morrison-sap
  committed
  16ded9c
- docs: anchor license allowlist to TSC + foundation licensing policy
  morrison-sap
  committed
  beb161a
- docs: scope 2FA and deploy-key controls to SCM/CI/registry plane
  morrison-sap
  committed
  6d143ad
- docs: note Dependabot/Renovate update SHA-pinned actions automatically
  morrison-sap
  committed
  7fd7483
- docs: anchor org owner count and clarify repo admin role in §9.5
  morrison-sap
  committed
  23b616d
- docs: restructure maintainer vetting criteria into numbered list
  morrison-sap
  committed
  9e1ff7e
- docs: add threat-modelling references to §9.7
  morrison-sap
  committed
  bc9765b
- docs: clarify Resolution column reference date in §10
  morrison-sap
  committed
  e8358a6
- docs: clarify multi-repo SECURITY.md fall-through (GitHub vs GitLab)
  morrison-sap
  committed
  3671b89
- docs: add EU Cyber Resilience Act (CRA) compliance requirements
  morrison-sap
  committed
  09b7980

Commits

Commits on Sep 14, 2026