[Required] Enforcing Access Control Rules to secure the code base against attacks (Example: two factor authentication enforcement, and/or use of ACL tools.)

[avishnu]

• Enable 2-factor authentication at the org level. Assess the impact on the bot users.
• Evaluate the OpenEBS people list, remove the inactive members from the project.

[avishnu]

Sample responses from other projects:

• All project maintainers use a two factor authentication
• Two factor authentication is enforced.
• As previously documented above, our repo uses GitHub teams and CODEOWNERS files to enforce merge and commit privileges. Because the project is on GitHub, 2FA is mandatory and enabled
• As a Github hosted project, we rely on the Github authentication mechanisms. Most of the maintainers use two factor authentication and sign commits and tags with GPG keys

[avishnu]

Our response:
OpenEBS code is hosted in GitHub and uses GitHub teams for controlling access to the various repositories. We have also enabled 2FA at the org level, which enforces Two Factor Authentication for all the org members. The org membership is periodically reviewed and kept relevant.