You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This document outlines the process for handling security incidents affecting any OpenJS project. Incidents may include platform changes with security implications, account compromise, or other security events that require coordinated response.
3
+
## Purpose & Role
5
4
6
-
The Foundation’s role is to:
7
-
1.**Receive and triage the Incident Reports**
8
-
2.**Connect incident reporters with experts who can help**
9
-
3.**Facilitate coordinated response** across multiple projects when needed
10
-
4.**Act as the contact point** while respecting confidentiality and responsible disclosure principles
5
+
This plan outlines how the OpenJS Foundation facilitates and coordinates responses to security incidents affecting supported projects.
11
6
12
-
---
13
-
14
-
## Scope
7
+
The Foundation acts as a **facilitator and coordinator**, not as the primary incident responder. Our focus is to unblock projects and reduce risk by:
15
8
16
-
This plan covers incidents such as:
17
-
-**Platform changes or provider outages with security implications** (e.g., compromised authentication systems, unexpected data exposure, service disruptions affecting security controls) that create security or operational risk.
- 🍿 @Discussion: Probably we can think on more scenarios together
32
+
**Out of Scope:**
33
+
- Code-level vulnerabilities in Foundation projects (handled by the project or OpenJS CNA Team)
34
+
- Non-Foundation projects — see [supported projects list](https://openjsf.org/projects)
36
35
36
+
🍿 @Discussion: Probably we can think on more scenarios together
37
37
38
38
| Category | Examples | Primary Response Role |
39
39
|----------|----------|-----------------------|
40
-
|**Vulnerability Report**| Code exploit, CVE disputes, escalations...| Redirect to the project or delegate to the CNA Team |
41
-
|**Platform changes or provider outages with security implications**|compromised authentication systems, unexpected data exposure, service disruptions affecting security controls... | Triage → Escalate to platform contacts → Provide mitigations|
42
-
|**Account Access Issue**| npm account lockout, GitHub MFA issues | Triage → Help restore access via platform → Provide temporary mitigation |
| Publish/Share (if approved) | I | R, A | C | C |
88
63
64
+
🍿 @Discussion: who should be in the team?
65
+
🍿 @Discussion: Should we publish learnings publicly to help the community?
89
66
67
+
---
90
68
91
-
#### Coordinator (SRC)
69
+
### Reporter
70
+
Submits an incident report to the Foundation Security Team.
92
71
93
-
This person acts as the focal point for a specific Incident Report and ensures the report follows all responsible disclosure guidelines. The SRC coordinates the remediation process if the situation is confirmed and ensures that the Incident Report follows the process and necessary actions are taken. While the SRC is not necessarily responsible for performing a detailed analysis or remediation.
72
+
**Responsibilities & Expectations**
73
+
- Provide detailed incident information
74
+
- Follow responsible disclosure guidelines
75
+
- Cooperate by supplying clarifications when needed
76
+
- Respect embargo and disclosure timelines
94
77
95
-
**Responsibilities**
78
+
---
96
79
97
-
- Acknowledge receipt of Incident Reports within the required timeframe.
98
-
- Orchestrate the embargo and identify the minimum set of individuals involved.
99
-
- Remind everyone involved that they must not notify/involve any other individuals. If someone else needs to be involved, that must go through the Coordinator.
100
-
- Assign one or multiple SMEs.
101
-
- Ensure communication with the reporter and the affected projects throughout the process.
102
-
- Track all the Incident Reports for visibility and reporting.
80
+
### Coordinator (SRC)
81
+
Focal point for each incident. Ensures process is followed and manages communications.
103
82
104
-
#### Subject Matter Expert (SME)
105
-
Experts brought in for technical insight, platform liaison work, or domain-specific advice.
83
+
**Responsibilities**
84
+
- Acknowledge reports promptly
85
+
- Manage embargo and limit information sharing
86
+
- Assign SMEs as needed
87
+
- Keep reporter and affected projects updated
88
+
- Track all incidents for reporting and visibility
106
89
107
-
**Responsibilities**:
108
-
- Provide expert input to help assess impact and options
109
-
- Advise on mitigation strategies
110
-
- Help unblock the situations when feasible
90
+
---
111
91
112
-
### Reporting method
92
+
### Subject Matter Expert (SME)
93
+
Provides technical, legal, or domain-specific expertise.
113
94
95
+
**Responsibilities**
96
+
- Help assess impact and options
97
+
- Recommend mitigation strategies
98
+
- Assist in unblocking projects when feasible
114
99
115
-
In [this webform](https://report-incident.openjsf.org/) is possible to create a new security report
100
+
---
116
101
102
+
## Reporting Method
117
103
118
-
## Runbook
104
+
Submit incidents through the [OpenJS Security Incident Webform](https://report-incident.openjsf.org/).
119
105
120
-
- 🍿 @Discussion: What is the best approach? Some ideas:
121
-
1.**Incident Report Received**
122
-
2.**Assign Coordinator** and consolidate report details
123
-
3.**Review** severity and affected projects
124
-
4.**Identify SMEs** and brief them
125
-
5.**Coordinate** with projects, platforms, or third parties
126
-
6.**Document** findings and lessons learned
127
-
7.**Publish** partial or full summary if appropriate
128
-
8.**Social Media Team** prepare and posts where needed
106
+
---
129
107
130
-
## General Response Workflow
108
+
## Response Workflow
131
109
132
-
-🍿 @Discussion: early-stage idea, based on the Runbook:
110
+
🍿 @Discussion: early-stage idea, based on the Runbook
0 commit comments