Validate process to report security issues

Clearly defined and discoverable process to report security issues.

Should be a link to a section in the security docs, iirc.

bootc meets both CNCF security documentation requirements:

1. Clearly defined and discoverable process to report security issues:

2. Document assignment of security response roles and how reports are handled:

GOVERNANCE.md defines Security Response Team
Appointment process: Maintainers appoint minimum 2 contributors
Annual review requirement
Clear responsibility: "handle all reports according to security policy"
Reference: https://github.com/bootc-dev/bootc/blob/main/GOVERNANCE.md#security-response-team

Comparison with CNCF Graduated Projects:

Uses same reporting method as containerd (GitHub Security Advisories)
Better cross-referencing than Kubernetes (external docs) or containerd (separate repo)
Appropriate depth for incubation stage

Both requirements fully met. ✅

Navigation Menu