Set security policies

[lizthegrey]

We should have a private [email protected] alias, GPG key, and set up SECURITY.md for all our repos.

[SergeyKanzhelev]

Do you have some links on best practices on how it will be used?

[yurishkuro]

Not claiming it's a best practice, but just as a reference to what we did in Jaeger. Website footer contains a link to report security issues

which takes you to https://www.jaegertracing.io/report-security-issue/

[lizthegrey]

That's correct, the goal is to enable people with critical security issues to responsibly disclose to us without going through public issue trackers, in order to allow us to remediate, push releases, and issue security advisories.

[lizthegrey]

I'll bring this up at Governance this week, but it's probably more properly a matter for the TC.

[SergeyKanzhelev]

Added to TC meeting agenda

[arminru]

Related PR by @jpkrohling: open-telemetry/opentelemetry-specification#990

[yurishkuro]

I would also recommend each repo to add an issue template "Report a security vulnerability".

Cf: https://github.com/jaegertracing/jaeger/issues/new/choose

[jpkrohling]

That one is actually a link to the policy, which is created automatically when you add a SECURITY.md to the repo.

[trask]

@open-telemetry/technical-committee just checking if this is still an open issue, or is resolved by open-telemetry/.github#1? thx!

[arminru]

@trask I think this can be resolved. The one from the meta repo also shows up here at https://github.com/open-telemetry/community/security/policy.

[yurishkuro]

Related: open-telemetry/sig-security#75