Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

[eu-cra-compliance:vulnerability-handling-auditor] githubnext/gh-cao CRA vulnerability handling audit

オープン
  • 何か問題がありますか？
#19,636 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
24/100
issue の種類
ドキュメント
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
github-actions, javascript
領域
documentation, security

調査の方向性

Start with SECURITY.md and SUPPORT.md, then review the referenced Regulation (EU) 2024/2847, Article 13, Article 14, and Annex I Part II. Draft the vulnerability lifecycle and support period documentation described in the agent prompt, preserving the private intake instructions and leaving legal and reportability decisions to human reviewers. Done means a maintainer runbook or supporting documentation defines the requested controls and an access-controlled sample links intake through communication and escalation timestamps.

索引モデルが issue の本文から書いたものです。

説明

eu-cra-compliance eu-cra-compliance:vulnerability-handling-auditor

The repository has a usable private intake route and strong build/release security controls, but public evidence does not define the complete vulnerability lifecycle or support period. Aggregate GitHub evidence shows 6 open high-severity code-scanning alerts and 4 open dependency alerts (1 critical, 1 high, 2 low); exploitability, age, and remediation decisions were not assessed. Legal role, scope, classification, reportability, and release eligibility remain human decisions.

Action: The security owner should assign the documentation work below to Copilot, then approve the resulting policy and verify that one access-controlled sample links intake, triage, affected versions, decision, fix, release, communication, and Article 14 escalation timestamps.

  • GAP_FOUND — no published acknowledgement target, confidentiality/coordination protocol, triage owner, severity/exploitability method, affected-version/root-cause record, or Article 14 escalation link. Topic: vulnerability handling; source: Regulation (EU) 2024/2847, Article 13 and Annex I Part II; official text; verified 2026-10-23.
  • GAP_FOUND — SUPPORT.md calls the project an active research prototype but gives no support period, supported-version inventory, or end-of-support process. Topic: support-period vulnerability handling; source: Regulation (EU) 2024/2847, Article 13 and Annex I Part II; official text; verified 2026-10-23.
  • GAP_FOUND — open scanner findings require documented ownership and disposition; this record does not infer active exploitation or reportability. Topic: identification and remediation; source: Regulation (EU) 2024/2847, Annex I Part II and Article 14; official text; verified 2026-10-23.
<b>Agent prompt</b>

Draft a focused vulnerability-management documentation change for githubnext/gh-cao. Extend SECURITY.md and SUPPORT.md, and add a maintainer runbook if needed. Define acknowledgement and coordination expectations; confidentiality and withheld-detail handling; named-role triage ownership; severity and exploitability assessment; affected-version and root-cause records; remediation/mitigation/rollback decisions; upstream/downstream and CNA/CVE coordination where applicable; free secure update and customer-communication steps; support periods, supported versions, and end-of-support communication; timestamp retention; scanner-exception ownership and review; and an Article 14 escalation path that requires human reportability decisions. Do not include vulnerability details or decide CRA scope, role, classification, conformity, reportability, or market-release eligibility. Add tests or link checks appropriate to documentation and preserve existing private intake instructions.

<b>Regulatory baseline and limitations</b> 
R1:
  topic: application dates
  status: EVIDENCE_SUFFICIENT
  dates: [2024-12-10, 2026-06-11, 2026-09-11, 2027-12-11]
  source:
    instrument: Regulation (EU) 2024/2847
    provision: Article 71
    authority: binding
  url: https://eur-lex.europa.eu/eli/reg/2024/2847/oj
  verified: 2026-10-23
R2:
  topic: manufacturer vulnerability handling and support period
  status: HUMAN_REVIEW_REQUIRED
  source:
    instrument: Regulation (EU) 2024/2847
    provision: Article 13 and Annex I Part II
    authority: binding
  url: https://eur-lex.europa.eu/eli/reg/2024/2847/oj
  verified: 2026-10-23
R3:
  topic: reporting escalation only; no reportability decision made
  status: HUMAN_REVIEW_REQUIRED
  source:
    instrument: Regulation (EU) 2024/2847
    provision: Article 14
    authority: binding
  url: https://eur-lex.europa.eu/eli/reg/2024/2847/oj
  verified: 2026-10-23

INCOMPLETE — the Commission CRA entry point returned access denied during this run, so the stated 27 July 2026 non-binding guidance issue date was not independently verified: https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act (checked 2026-10-23). NOT_ASSESSED — no conclusion was made on delegated or implementing acts, OJ-referenced harmonised standards, or applicable certification schemes. The ENISA entry point was checked, but no project-specific applicability conclusion was made: https://www.enisa.europa.eu/.

<b>Lifecycle control matrix</b>
Control / independently testable claim Status Evidence or limitation Requirement source; verification
Private disclosure intake EVIDENCE_SUFFICIENT SECURITY.md rejects public reports and provides a private security address plus requested reproduction/impact fields. Annex I Part II; official text; 2026-10-23
Acknowledgement, researcher coordination, confidentiality GAP_FOUND No public process found. Internal evidence was not accessible. Annex I Part II; official text; 2026-10-23
Triage, severity/exploitability, affected versions, root cause, decision INCOMPLETE Aggregate alerts were readable; access-controlled case records were not examined. Article 13, Annex I Part II; official text; 2026-10-23
Regular tests, dependency/code scanning, component records EVIDENCE_SUFFICIENT CI has broad tests. The package workflow gates high/critical findings with Trivy and Grype, generates SPDX, seals checksums, and attests SBOM/provenance. One scanner exception documents no upstream fix but has no explicit owner/review date. Annex I Part II; official text; 2026-10-23
Fixes, secure distribution, rollback, release/customer communication INCOMPLETE Immutable releases, digests, attestations, independent promotion approval, and generated notes are evidenced; fix SLA, free-update policy, rollback/mitigation procedure, and security-advisory communication are not. Article 13, Annex I Part II; official text; 2026-10-23
Upstream/downstream, CNA/CVE, withheld details INCOMPLETE No public operating record found; internal evidence not accessible. Annex I Part II; official text; 2026-10-23
Support period and end-of-support GAP_FOUND No duration, supported-version list, or end-of-support notice process. Article 13, Annex I Part II; official text; 2026-10-23
Timestamp chain and Article 14 escalation INCOMPLETE GitHub preserves workflow/release timestamps; awareness, triage, correction, and communication linkage was not verified. Articles 13–14; official text; 2026-10-23
<b>Sampled traceability and what is working</b>
  • EVIDENCE_SUFFICIENT — release v0.1.28 binds source d29ce7b..., publication 2026-10-22T08:42:56Z, 11 immutable assets with SHA-256 digests, and successful release run 39749113405.
  • EVIDENCE_SUFFICIENT — package run 39892121399 on audited SHA 4bba110... completed successfully from 2026-10-23T02:54:29Z to 03:00:47Z.
  • What is working: the release path unusually well binds exact source, scans, checksums, attestations, immutable assets, and independent human promotion approval.
  • INCOMPLETE — these samples establish release integrity, not end-to-end vulnerability case handling. No confidential case was requested or exposed.
<b>Human-review decisions and inaccessible evidence</b>

HUMAN_REVIEW_REQUIRED for CRA scope/exclusion, economic-operator role, commercial versus non-commercial FOSS treatment, substantial modification, Class I/Class II or critical-product classification, conformity route, any harmonised-standard or certification-scheme applicability, presumption of conformity, active exploitation, severe-incident threshold, reportability, declaration readiness, and final market-release eligibility.

INCOMPLETE: private disclosure mailbox records; acknowledgement/coordination history; security advisory content; triage and root-cause records; affected-version inventory; remediation SLA/decisions; customer communications; and support/end-of-support records. Review these only in their access-controlled systems.

Human Acceptance

A non-bot security or compliance reviewer should add a 👍 reaction only after reviewing the complete vulnerability lifecycle controls, process evidence, sampled traceability, prioritized gaps, inaccessible evidence, and the human decisions above. This issue does not claim acceptance.

cao: githubnext/gh-cao, correlation: 39900760283-891

Generated by 🐛 EU CRA / Vulnerabilities · pi · gpt56 · ~75 AIC · ⌖ ~14 AIC · ⊞ 13.3K · ◷

  • expires on Nov 22, 2026, 4:45 AM UTC
主要言語
JavaScript
スター
8
フォーク
5
平均マージ
2時間 28分
マージ済み PR（30日）
849

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

githubnext/gh-cao のほかの issue

githubnext/gh-cao の issue をすべて見る

似ている issue

JavaScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。