GitHub write access and the documented roster describe two different
projects: ten people hold write or admin on this repository without
appearing in MAINTAINERS.md, and three people listed there hold only
read. CNCF Incubation requires code ownership in GitHub to match
documented governance roles, and there is no in-between state for it.
Add the three contributors whose work is project-wide -- lexfrei,
myasnikovdaniil and IvanHunters -- as maintainers, and introduce a
Reviewers table for people who own a specific area with write access but
not the project-wide responsibilities of a maintainer. The Reviewer tier
already existed in CONTRIBUTOR_LADDER.md and had never been used; the
area-to-owner mapping stays in .github/CODEOWNERS, which this table
mirrors.
Also name the maintainers who triage security reports, so the Required
'contact information' item points at people rather than at a list.
Assisted-By: Claude
Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
Bring the security documentation in line with controls that are already
in place, and add the two coordinated-disclosure items flagged during the
incubation due-diligence review.
- self-assessment: DCO is enforced by an automated check; private intake
is GitHub Private Vulnerability Reporting; OpenSSF passing badge achieved
2026-04-01 (working toward silver); GHSA/PVR framing for advisory history;
incident-response now summarized publicly.
- SECURITY.md: route reports to Private Vulnerability Reporting with a
MAINTAINERS.md fallback; add a 90-day coordinated-disclosure window and a
CVSS-based remediation-target table.
- CODEOWNERS: document that it encodes the area-scoped Reviewer role, which
is intentionally distinct from the MAINTAINERS.md governance roster, and
that security reporting is not routed through this file.
- Add docs/security/incident-response.md as the public incident runbook.
Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: tym83 <6355522@gmail.com>
Record the repository's automated security analysis in SECURITY.md: CodeQL
SAST (manual Go build, runs per-PR/push/weekly, new-alert-on-diff, intended
as a required pre-merge check, dismiss-with-reason for false positives) and
OpenSSF Scorecard (supply-chain posture, published to the scorecard.dev
badge, intentionally not uploaded to code scanning). Mirrors the workflow
changes in this PR so the security posture is documented, not just encoded
in YAML.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Andrei Kvapil