The ground truth for security reports is the email archive: as with the "if it didn't happen on the list, it didn't happen" adage, per the security report handling policy, security issues come in via email to security@apache.org or a project-specific security list, and responses to the reporter (either rejecting or accepting the report) are expected to be Cc'ed to that list as well.

On its own this is not ideal: it's easy to lose track of what threads still need attention. For that reason the Security team has a lightweight thread tracking system that is exposed to PMCs and project security teams via https://dash.security.apache.org. We plan to evolve this tool to provide additional utilities, feedback welcome.

Projects with few security issues

For the vast majority of ASF projects, who quickly triage incoming reports and only have a few valid issues open at any given time, no more is needed.

Projects with more security issues

Some projects deal with larger volumes of security reports. The best solution to this would be try and keep the number of issues down by more aggressively triaging incoming reports and, if necessary, more quickly/frequently making releases with fixes. 

If the volume remains higher even with those activities, it can be helpful to use a more structured system to augment the email workflow. We don't recommend any particular tool as a one-size-fits-all solution: since ASF projects are largely autonomous, different projects have different approaches that work well for them, including:

  • A category in their regular Jira project for security-sensitive issues
  • A separate private Jira project
  • A separate private GitHub project with issues
  • A table on a private Confluence page
  • A private SVN directory with some structure for PoCs and drafts
  • An 'agentic' workflow based on https://github.com/apache/magpie

https://dash.security.apache.org exposes a simple API that might ideally help detect when such 'internal' tracking and the externally-observed state go out of sync, providing an extra safeguard to make sure everything is handled.

  • No labels