[Initiative]: Update Project Security Guidelines
Maintainers usually reply within 1 day
@Satarupa22-SD is already working on this.
Since Jun 24, 2026.
Assessment
This issue has not been assessed yet.
Description
Name
Update Project Security Guidelines and Templates
Short description
Update the security guidelines and templates on contribute.cncf.io
Responsible group
TAG Security and Compliance
Does the initiative belong to a subproject?
No
Subproject name
No response
Primary contact
@jkjell
Additional contacts
No response
Initiative description
A continuation of https://github.com/cncf/tag-security/issues/1260 to update the guidance found on the CNCF's contribute.cncf.io for best practices around project's Security Hygiene. Additionally, there are templates for some security sections that may also need to be updated.
While all areas of the current guidance should be updated for relevancy and accuracy, some potential new areas. TAG Security and Compliance often receives questions around and can offer authoritative guidance on:
- Security Baseline
- SBOM and SLSA Build Provenance generation
- Dependency review and selection
- GitHub Actions Workflows security
Additional topics and areas may considered upon TAG S&C leadership agreement and community interest.
Deliverable(s) or exit criteria
- Review of current guidance for relevancy and accuracy
- Creation of well defined tasks to update specific existing sections
- Creation of well defined tasks to add new relevant sections
- New sections added for:
- Security Baseline
- SBOM and SLSA Build Provenance generation
- Dependency review and selection
- GitHub Actions Workflows security
Tracking document for meeting and progress
- Dominant language
- HTML
- Stars
- 1.9k
- Forks
- 728
- Avg merge
- 3d 23h
- Merged PRs (30d)
- 10
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from cncf/toc
-
fix(generator): correct struct tag for subproject_leads in Leadership structPossibly taken @Tharun-Varshan-S claimed this 2 days ago. Openneeds-group needs-kind needs-triage
Difficulty 1/5 Under an hour Newbie friendliness 25/100
Maintainers usually reply within 1 day
-
kind/review needs-triage review/health toc
Difficulty 5/5 Over a week Newbie friendliness 5/100
Maintainers usually reply within 1 day
-
kind/initiative needs-group needs-triage
Difficulty 5/5 Over a week Newbie friendliness 18/100
Maintainers usually reply within 1 day
-
[Initiative]: Telco AI NativePossibly taken @kashifest claimed this 7 days ago. Openkind/initiative tag/infrastructure triage/valid
Difficulty 5/5 Over a week Newbie friendliness 20/100
cncf/toc#2314 · 14 comments · 2 reactions · 1 assignee ·
Maintainers usually reply within 1 day
-
kind/initiative needs-group needs-triage
Difficulty 5/5 Over a week Newbie friendliness 30/100
Maintainers usually reply within 1 day