search

kubernetes / website

Kubernetes website and documentation repo:
https://kubernetes.io
Creative Commons Attribution 4.0 International
4.49k stars 14.41k forks source link

Add a `security.txt` #42693

Closed sftim closed 8 months ago

sftim commented 1 year ago

This is a Feature Request

What would you like to be added Add a https://k8s.io/.well-known/security.txt page, based on RFC 9116

Why is this needed

Many security researchers encounter situations where they are unable to report security vulnerabilities to organizations because there are no reporting channels to contact the owner of a particular resource, and no information is available about the vulnerability disclosure practices of such owner.

We can provide a machine-parseable way for people to find out how to disclose security vulnerabilities, as well as what not to disclose. (eg: it's possible to socially engineer a contributor into liking a ~tweet~ X post by an imposter)

Comments Ideally (?), we'd also sign the file using PGP

Original suggestion

/sig security

whitebeard10 commented 1 year ago

/assign

raesene commented 1 year ago

/triage accepted

sftim commented 1 year ago

/priority important-longterm

ashish493 commented 1 year ago

@whitebeard10 If you have started working on it, let me know if any help is required. Even I am interested in contributing to it.

ashish493 commented 1 year ago

@sftim do we also need to write a KEP for this issue, since you have mentioned that in the previous slack discussion?

whitebeard10 commented 1 year ago

i am still working on it, will let you know for any help for sure @ashish493

sftim commented 1 year ago

do we also need to write a KEP for this issue, since you have mentioned that in the previous slack discussion?

The best group of people to ask about this are Kubernetes SIG Security.

coder12git commented 10 months ago

/assign

coder12git commented 10 months ago

Have a look on this PR -> https://github.com/kubernetes/website/pull/44487