ALL-SECU1002 · vulnerability_response_readiness
Judge whether a project can receive and resolve vulnerability reports.
This is a contextual rule for all languages. Read its implementation.
Definition
Section titled “Definition”Compare private reporting, scope, ownership, triage, response objectives, advisory creation, coordinated disclosure, patch production, release, notification, and retrospective evidence.
Evidence
Section titled “Evidence”Findings cite security policy, contacts, owners, objectives, advisory tools, release path, and previous response evidence.
Exceptions
Section titled “Exceptions”Private transient components may inherit a clearly identified parent response process.
Examples
Section titled “Examples”A current private reporting path with an owner and tested advisory-to-release workflow is
ready. A stale email address with no patch owner is partial or absent.
References
Section titled “References”- Cites “OpenSSF Best Practices Badge”, vulnerability reporting criteria
- Cites “Open Source Project Security Baseline”
- Cites “GitHub documentation”, security advisory