Skip to content

docs: update SECURITY.md with NeoNephos guidelines and CRA compliance - #115

Merged
morri-son merged 4 commits into
open-component-model:mainfrom
morri-son:ocm/add-neonephos-security-policy
Sep 17, 2026
Merged

docs: update SECURITY.md with NeoNephos guidelines and CRA compliance#115
morri-son merged 4 commits into
open-component-model:mainfrom
morri-son:ocm/add-neonephos-security-policy

Conversation

@morri-son

@morri-son morri-son commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Overview

Update the organization-wide SECURITY.md to align with NeoNephos Foundation security standards and EU Cyber Resilience Act (CRA) compliance requirements.

Changes

  • Replace SAP-focused security policy with Open Component Model specific policy
  • Reference NeoNephos Security Guidelines for standardized vulnerability handling
  • Add CRA stewardship statement per Linux Foundation requirements
  • Document commercial intent (required for CRA compliance)
  • Include escalation contact for CRA: steward@linuxfoundation.org
  • Align response timelines with NeoNephos standards:
    • Initial response: 14 calendar days
    • Vulnerability embargo: up to 90 days
    • Severity-based response targets (Critical, High, Medium, Low)

CRA Compliance Details

Implementation Notes

This update follows the standardized approach adopted by all NeoNephos Foundation projects as of the September 2026 Linux Foundation guidance update. All commits include DCO sign-off for compliance audit trail.

Related

@morri-son
morri-son requested a review from a team as a code owner September 14, 2026 15:36
@morri-son
morri-son force-pushed the ocm/add-neonephos-security-policy branch from 965cfb4 to 2102b81 Compare September 14, 2026 15:38
@morri-son morri-son mentioned this pull request Sep 14, 2026
Merged
4 tasks done
@morri-son
morri-son force-pushed the ocm/add-neonephos-security-policy branch 2 times, most recently from 225370b to de8fad8 Compare September 14, 2026 16:04
frewilhelm
frewilhelm reviewed Sep 15, 2026
View reviewed changes
Comment thread SECURITY.md Outdated
frewilhelm
frewilhelm reviewed Sep 15, 2026
View reviewed changes
Comment thread SECURITY.md Outdated
morri-son added a commit to open-component-model/open-component-model that referenced this pull request Sep 16, 2026
@morri-son @morrison-sap
@matthiasbruns @coderabbitai
docs: update security.txt and re-introduce workflow to update the exp…
6579bd7 
…iry date every year (#2386)

## Summary

Add security.txt and a workflow to update it for Open Component Model
vulnerability disclosure, aligned with NeoNephos Security Guidelines and
CRA compliance requirements.

**Important**: The organization-wide has been moved to a separate PR in
the repository (see Related PRs below). This PR focuses on tooling,
workflows, and security.txt updates only.

## Changes

- ✅ Update `website/static/.well-known/security.txt` (RFC 9116
compliance)
  - Reference new reporting channels and contacts
  - Add Expires field with automated renewal workflow
  
- ✅ Restore automated security.txt expiry renewal workflow
  - Runs every weekday in December at 09:00 UTC
  - Automatically updates Expires field to next year
  - Creates idempotent PR for review and merge
  - Ensures RFC 9116 compliance without manual maintenance

- ✅ Security documentation references
  - Links to `docs/security/secure-design.md`
  - Links to `docs/security/assurance-case.md`

## Related PRs

**⚠️ MERGE ORDER MATTERS:**

1. **FIRST**: Merge `open-component-model/.github#115`
   - Organization-wide SECURITY.md (applies to all repos)
   - NeoNephos Security Guidelines compliance
   - CRA stewardship statement per Linux Foundation
   - Commercial intent declaration
   - URL: open-component-model/.github#115

2. **THEN**: Merge this PR
(`#2386`)
   - Security tooling and automation
   - security.txt updates

**Reason**: The .github SECURITY.md is organization-wide and is
referenced by this PR's security.txt updates.

## Compliance

- ✅ RFC 9116 (security.txt standard)
- ✅ NeoNephos Security Guidelines
- ✅ CRA (EU Cyber Resilience Act) stewardship
- ✅ DCO sign-off on all commits

## Test Plan

- [x] Verify `security.txt` is valid per RFC 9116
- [x] Verify `security.txt` references correct SECURITY.md location
- [x] Verify workflow runs correctly (manual trigger or wait for
December)
- [x] Verify Expires field updates to next year + 12-31

## Closes

- open-component-model/ocm-project#683 (security.txt automation)

---------

Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Signed-off-by: Gerald Morrison <67469729+morri-son@users.noreply.github.com>
Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Co-authored-by: Matthias Bruns <github@matthiasbruns.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
ocmbot Bot pushed a commit to open-component-model/open-component-model that referenced this pull request Sep 16, 2026
@github-actions @morrison-sap @matthiasbruns
docs: update security.txt and re-introduce workflow to update the exp…
44d67d8 
…iry date every year (#2386)

## Summary

Add security.txt and a workflow to update it for Open Component Model
vulnerability disclosure, aligned with NeoNephos Security Guidelines and
CRA compliance requirements.

**Important**: The organization-wide has been moved to a separate PR in
the repository (see Related PRs below). This PR focuses on tooling,
workflows, and security.txt updates only.

## Changes

- ✅ Update `website/static/.well-known/security.txt` (RFC 9116
compliance)
  - Reference new reporting channels and contacts
  - Add Expires field with automated renewal workflow

- ✅ Restore automated security.txt expiry renewal workflow
  - Runs every weekday in December at 09:00 UTC
  - Automatically updates Expires field to next year
  - Creates idempotent PR for review and merge
  - Ensures RFC 9116 compliance without manual maintenance

- ✅ Security documentation references
  - Links to `docs/security/secure-design.md`
  - Links to `docs/security/assurance-case.md`

## Related PRs

**⚠️ MERGE ORDER MATTERS:**

1. **FIRST**: Merge `open-component-model/.github#115`
   - Organization-wide SECURITY.md (applies to all repos)
   - NeoNephos Security Guidelines compliance
   - CRA stewardship statement per Linux Foundation
   - Commercial intent declaration
   - URL: open-component-model/.github#115

2. **THEN**: Merge this PR
(`#2386`)
   - Security tooling and automation
   - security.txt updates

**Reason**: The .github SECURITY.md is organization-wide and is
referenced by this PR's security.txt updates.

## Compliance

- ✅ RFC 9116 (security.txt standard)
- ✅ NeoNephos Security Guidelines
- ✅ CRA (EU Cyber Resilience Act) stewardship
- ✅ DCO sign-off on all commits

## Test Plan

- [x] Verify `security.txt` is valid per RFC 9116
- [x] Verify `security.txt` references correct SECURITY.md location
- [x] Verify workflow runs correctly (manual trigger or wait for
December)
- [x] Verify Expires field updates to next year + 12-31

## Closes

- open-component-model/ocm-project#683 (security.txt automation)

---------

Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Signed-off-by: Gerald Morrison <67469729+morri-son@users.noreply.github.com>
Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Co-authored-by: Matthias Bruns <github@matthiasbruns.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> 6579bd7
frewilhelm
frewilhelm previously approved these changes Sep 17, 2026
View reviewed changes
@morri-son
morri-son enabled auto-merge (squash) September 17, 2026 10:30
matthiasbruns
matthiasbruns reviewed Sep 17, 2026
View reviewed changes
Comment thread SECURITY.md
matthiasbruns
matthiasbruns reviewed Sep 17, 2026
View reviewed changes
Comment thread SECURITY.md
matthiasbruns
matthiasbruns reviewed Sep 17, 2026
View reviewed changes

@matthiasbruns matthiasbruns left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nits

@morri-son
morri-son force-pushed the ocm/add-neonephos-security-policy branch 2 times, most recently from 767aadd to 0e6695c Compare September 17, 2026 12:21
morrison-sap and others added 4 commits September 17, 2026 14:23
@morrison-sap
docs: update SECURITY.md to follow NeoNephos guidelines with CRA comp…
0360d7b 
…liance

- Replace SAP security policy with Open Component Model specific policy
- Reference NeoNephos Security Guidelines for standardized vulnerability handling
- Add CRA stewardship statement per Linux Foundation requirements
- Document commercial intent (required for CRA)
- Include escalation contact for CRA (steward@linuxfoundation.org)
- Align response timelines with NeoNephos standards (14 days initial, 90-day embargo)
- Reference OpenSSF Best Practices alignment

Signed-off-by: Gerald Morrison (D032990) <gerald.morrison@sap.com>
@morrison-sap
docs: replace repo-specific advisory link with org-wide guidance
4b36044 
SECURITY.md is the org-wide default, so a hard-coded link to one
repository's advisory list is wrong in every other repo. GitHub's
org-wide advisory view is restricted to org owners/security managers,
so replace the link with a per-repository placeholder URL and point
readers to the Security tab of the affected repository.

Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
On-behalf-of: Gerald Morrison (SAP) <gerald.morrison@sap.com>
@morri-son @frewilhelm @morrison-sap
Update SECURITY.md
27decd9 
Co-authored-by: Frederic Wilhelm <fre.wilhelm@gmail.com>
Signed-off-by: Gerald Morrison <67469729+morri-son@users.noreply.github.com>
@morri-son @morrison-sap
Update SECURITY.md
3c06166 
Signed-off-by: Gerald Morrison <67469729+morri-son@users.noreply.github.com>
@morri-son
morri-son force-pushed the ocm/add-neonephos-security-policy branch from 0e6695c to 3c06166 Compare September 17, 2026 12:23
@morri-son
morri-son merged commit 9e90167 into open-component-model:main Sep 17, 2026
2 checks passed
@morri-son morri-son mentioned this pull request Sep 17, 2026
Merged
2 tasks done
morri-son added a commit to open-component-model/open-component-model that referenced this pull request Sep 22, 2026
@morri-son @morrison-sap
docs(website): point security sections at new org SECURITY.md (#3633)
97a8af1 
## Summary

The org-wide
[SECURITY.md](https://github.com/open-component-model/.github/blob/main/SECURITY.md)
(merged via open-component-model/.github#115) now carries the OCM
security policy aligned with the NeoNephos security guidelines. This PR
links it from the website's security-reporting sections:

- `community/_index.md`: Security section now also links the Security
Policy directly.
- `community/contributing.md`: Reporting section mentions the TSC email
(`open-component-model-tsc@lists.neonephos.org`) as fallback channel and
links the policy for supported versions, response targets, and the
disclosure process.

Refs open-component-model/ocm-project#683

## Test plan

- [x] markdownlint clean on both changed files (same config as CI)
- [x] Hugo renders community pages (link check in CI)

---------

Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
ocmbot Bot pushed a commit to open-component-model/open-component-model that referenced this pull request Sep 22, 2026
@github-actions
docs(website): point security sections at new org SECURITY.md (#3633)
0c57eba 
## Summary

The org-wide
[SECURITY.md](https://github.com/open-component-model/.github/blob/main/SECURITY.md)
(merged via open-component-model/.github#115) now carries the OCM
security policy aligned with the NeoNephos security guidelines. This PR
links it from the website's security-reporting sections:

- `community/_index.md`: Security section now also links the Security
Policy directly.
- `community/contributing.md`: Reporting section mentions the TSC email
(`open-component-model-tsc@lists.neonephos.org`) as fallback channel and
links the policy for supported versions, response targets, and the
disclosure process.

Refs open-component-model/ocm-project#683

## Test plan

- [x] markdownlint clean on both changed files (same config as CI)
- [x] Hugo renders community pages (link check in CI)

---------

Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com> 97a8af1
skarlso-release-bot Bot pushed a commit to Skarlso/open-component-model that referenced this pull request Sep 22, 2026
@github-actions
docs(website): point security sections at new org SECURITY.md (open-c…
095ce95 
…omponent-model#3633)

## Summary

The org-wide
[SECURITY.md](https://github.com/open-component-model/.github/blob/main/SECURITY.md)
(merged via open-component-model/.github#115) now carries the OCM
security policy aligned with the NeoNephos security guidelines. This PR
links it from the website's security-reporting sections:

- `community/_index.md`: Security section now also links the Security
Policy directly.
- `community/contributing.md`: Reporting section mentions the TSC email
(`open-component-model-tsc@lists.neonephos.org`) as fallback channel and
links the policy for supported versions, response targets, and the
disclosure process.

Refs open-component-model/ocm-project#683

## Test plan

- [x] markdownlint clean on both changed files (same config as CI)
- [x] Hugo renders community pages (link check in CI)

---------

Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com> 97a8af1
ocmbotneisener Bot pushed a commit to jneisener/open-component-model that referenced this pull request Sep 22, 2026
@github-actions
docs(website): point security sections at new org SECURITY.md (open-c…
bfaf24a 
…omponent-model#3633)

## Summary

The org-wide
[SECURITY.md](https://github.com/open-component-model/.github/blob/main/SECURITY.md)
(merged via open-component-model/.github#115) now carries the OCM
security policy aligned with the NeoNephos security guidelines. This PR
links it from the website's security-reporting sections:

- `community/_index.md`: Security section now also links the Security
Policy directly.
- `community/contributing.md`: Reporting section mentions the TSC email
(`open-component-model-tsc@lists.neonephos.org`) as fallback channel and
links the policy for supported versions, response targets, and the
disclosure process.

Refs open-component-model/ocm-project#683

## Test plan

- [x] markdownlint clean on both changed files (same config as CI)
- [x] Hugo renders community pages (link check in CI)

---------

Signed-off-by: Gerald Morrison (SAP) <gerald.morrison@sap.com>
Co-authored-by: Gerald Morrison (SAP) <gerald.morrison@sap.com> 97a8af1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Skarlso Skarlso Skarlso approved these changes
@matthiasbruns matthiasbruns matthiasbruns approved these changes
@frewilhelm frewilhelm Awaiting requested review from frewilhelm

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@morri-son @Skarlso @matthiasbruns @frewilhelm @morrison-sap