Pushkar Joglekar
Pushkar Joglekar
**NOTE: We should let multiple folks review and approve this PR before merging** Fixes https://github.com/cncf/tag-security/issues/947 - Uses an existing GitHub Action from Marketplace: `necojackarc/[email protected]` to allow notifying non-collaborators / codeowners...
Description: Revisit security assessment process to include the assessment of sub-projects of graduated projects by using [Cluster API](https://github.com/kubernetes-sigs/cluster-api/) sub-project of [Kubernetes](github.com/kubernetes/kubernetes) as a pilot Impact: This will create precedence on...
Working draft (RFC ends April 27): https://docs.google.com/document/d/1fftLBt3XjDzyYQisEKH3TZXL1QnT_cHIbBnFtW98UOs/edit ## Description Original security whitepaper (#138) was published in Nov 2020, about 9 months ago. It is now time to update the paper...
**Description**: With https://github.com/kubernetes/sig-security/issues/8 completed it is a good idea to perform a retrospective on what we learnt from the the pilot and how the lessons learnt could improve the overall...
Description: Vulnerability scanners detect CVEs in build time dependencies. But, Best practices to triage these vulnerabilities are unclear Impact: Adding docs based on experiences and anecdotes, that many projects can...
Sub-project has now been identified: https://github.com/kubernetes/sig-security/pull/48
### Enhancement Description - One-line enhancement description (can be used as a release note): Auto-refreshing official CVE feed - Slack thread about Code Freeze discussion: https://kubernetes.slack.com/archives/C2C40FMNF/p1659035059991979 - Kubernetes Enhancement Proposal:...
## Description Original security whitepaper (#138) was published in Nov 2020, followed by version 2 (#747) in May 2022. Since then we have received a lot of community feedback for...
- Clarified language on announcement of medium/low CVEs with public fixes - Updated the CVSS calculator from 3.1 to 3.0 - Added useful tips in comms. template for vulnerability announcement...
### New repo, staging repo, or migrate existing migrate existing: aquasecurity/vuln-list-k8s ### Is it a staging repo? no ### Requested name for new repository cve-feed-osv ### Which Organization should it...