Zowe Security Points for zowe.org

[armstro]

What should we say "for the record" on Zowe and security - starting points:

• Zowe is for for z/OS by z/OS knowledgeable contributors who understand the unique role for z/OS in the world
• We adhere to CII practices (silver today moving to gold) - provide pointer/link
• We utilize OMP security practices (DCO and scans) - scans to be confirmed
• The contributing vendors have their own security practices in addition to the open community and they bring their expertise to the community
• There is a Security team where anyone can raise concerns (questions)
• We seek a balance between transparency and maintaining good security practices
• What to say about reporting on vulnerabilities either when know? when fixed?

[PeterFandelAtRocket]

Security squad is working on this and will result in a charter of sorts that should address this issue. To be reviewed once it is ready for review.

[pdubz3]

This is being tracked by the system squad, ZAC issue no longer needed.