Tabitha Sable

Add GitHub Token leak process

3

Add a lightweight guide for responding to a GitHub token leak.

Add container image vuln response template.

1

This is essentially the same as the non-vulnerability-report template, but slightly customized.

Add docs about use of CLI utility to request CVEs from new CVE API

1

@micahhausler you had good luck using that tool, and it's apparently open-source. Can you please write up a few notes about how to do it?

Create comms template for owner outreach within project

2

This should help streamline sending initial "we have a vuln report" emails, and can provide a place to remind codeowners about careful treatment of non-public vulnerability information.

Add leads@ to onboarding documentation

5

Per notification from Steering, SRC members should PR themselves into the leads@ list [here](https://github.com/kubernetes/k8s.io/blob/main/groups/groups.yaml) We also need to add that as a step to the onboarding and offboarding process docs.

Add OSS-Fuzz to onboarding documentation

3

Add a step to the onboarding and offboarding documentation to PR SRC members into the OSS-Fuzz [contacts list for Kubernetes](https://github.com/google/oss-fuzz/blob/master/projects/kubernetes/project.yaml).

Automatically `make generate` when sigs.yaml is updated

12

### Describe the issue (Filing issue after being prompted during Leads meeting) After updating `sigs.yaml` it's necessary to run `make generate` which takes a really long time and a lot...

Add SIG Security as a stakeholder SIG for WG Policy

5

### Describe the issue SIG Security hosts WG Policy's artifacts and shares many concerns with WG Policy. We should probably be listed as a stakeholder SIG. Filing this as an...

WIP CONTRIBUTING.md for SIG Security

7

Add CONTRIBUTING.md that describes how to begin contributing to Kubernetes SIG Security

There is a useful HackerOne feature where folks can be granted access to just one specific H1 issue, which can be useful when members of a fix team are highly...