Repository navigation
Update Security policy for OCM project (also linked on Website) #683
Description
Goal
Replace the inherited SAP SECURITY.md with an OCM-specific policy aligned with the NeoNephos Foundation security guidelines, and align the website's security-reporting section with it.
Blocked by
NeoNephos security guidelines + SECURITY.md template: neonephos/guidelines-development#7 (open, not yet merged).
Tasks
- Add
SECURITY.mdtoopen-component-model/open-component-modelbased on the NeoNephos template (PR docs: update security.txt and re-introduce workflow to update the expiry date every year open-component-model#2386, draft). - Update the website's security-reporting section to point at the new policy:
website/content/community/_index.md— "Security" sectionwebsite/content/community/contributing.md—#reporting-security-vulnerabilitiesanchor
- Delete the
SECURITY_TXT_READrepo/org secret (no longer needed).
Done when
- New
SECURITY.mdmerged and reachable from the website's "Security" section under https://ocm.software/community/. - No remaining references to the SAP
SECURITY.mdinopen-component-model/.githubfrom website or repo.
Context
- Secure-design and assurance-case docs are already in place (
docs/security/secure-design.md,docs/security/assurance-case.md, merged via docs: add consolidated security design and assurance case open-component-model#2290). This issue tracks only the policy/disclosure piece. - The original
https://ocm.software/community/engagement/URL no longer exists; it now redirects via alias to/community/. The security link to update lives incommunity/_index.mdandcommunity/contributing.md. - Supersedes Create consolidated security design and assurance case document #1021.
Metadata
Metadata
Assignees
Type
Fields
Priority
High
Projects
- Status
Activity
[-]Update Security statement on Website[/-][+]Update Security policy for OCM project (also linked on Website)[/+]chore: remove workflow updating security text (#2679)
chore: remove workflow updating security text (open-component-model#2679
6 remaining items
docs: update security.txt and re-introduce workflow to update the exp…
frewilhelm commentedon Sep 21, 2026
Taking a look at it, since @morri-son is out
ocmbot commentedon Sep 22, 2026
Sprint hygiene: automatically moved from Sprint 71 - Stellar Standup to Sprint 72 - Pod Patrol because this issue had an expired sprint.
docs(website): point security sections at new org SECURITY.md (#3633)
docs(website): point security sections at new org SECURITY.md (#3633)
docs(website): point security sections at new org SECURITY.md (open-c…
docs(website): point security sections at new org SECURITY.md (open-c…