openid/ssf-wise-profile

Issues somebody may already be working on are listed last. List everything by date

• Agent workloads: changes to model, instructions, or toolset have no event, and -04 removed the nearest one

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  openid/ssf-wise-profile#55 · Opened Oct 27, 2026

• Supply chain events: a vulnerability feed is a target list, and referenced documents are not integrity-protected

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 4/5 3-5 days Newbie friendliness 35/100

  openid/ssf-wise-profile#54 · 1 comment · Opened Oct 27, 2026

• workload-vulnerability-status-changed: no way to say a vulnerability is being actively exploited

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  openid/ssf-wise-profile#53 · Opened Oct 27, 2026

• workload-vulnerability-status-changed: adopts VEX statuses but drops the VEX requirements that make relaxing statuses trustworthy

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 5/5 Over a week Newbie friendliness 28/100

  openid/ssf-wise-profile#52 · Opened Oct 27, 2026

• Obligation of action on event

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 2/5 1-3 hours Newbie friendliness 68/100

  openid/ssf-wise-profile#51 · 2 comments · Opened Oct 27, 2026

• Describe SSF metadata requirements by WISE

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 5/5 Over a week Newbie friendliness 25/100

  openid/ssf-wise-profile#46 · Opened Oct 6, 2026

• Trust anchor and federation events should be informational and shouldn't be able to establish trust on their own

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 5/5 Over a week Newbie friendliness 38/100

  openid/ssf-wise-profile#45 · Opened Oct 4, 2026

• `trust_domain` duplicates `sub_id` on trust and federation events (2.6.1 to 2.6.6)

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 2/5 1-3 hours Newbie friendliness 72/100

  openid/ssf-wise-profile#44 · Opened Oct 4, 2026

• Make trust anchor identifiers REQUIRED (2.6.1 to 2.6.3): an ambiguous anchor revocation can take down a whole trust domain

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  openid/ssf-wise-profile#43 · Opened Oct 4, 2026

• (4.4) `compromise response` lets any Transmitter trigger immediate revocation or isolation, which opens a denial-of-service vector

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  openid/ssf-wise-profile#42 · Opened Oct 4, 2026

• Add optional `tracking_id` and `expected_resolution` to `workload-vulnerability-status-changed` to support audits and remediation planning

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 4/5 3-5 days Newbie friendliness 48/100

  openid/ssf-wise-profile#41 · Opened Oct 4, 2026

• `under_investigation` on `workload-vulnerability-status-changed` needs a defined way to be resolved

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 4/5 3-5 days Newbie friendliness 48/100

  openid/ssf-wise-profile#40 · Opened Oct 4, 2026

• What is the point of sending `pending`? Only send terminal posture evaluation status on `workload-baseline-changed`

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  openid/ssf-wise-profile#39 · Opened Oct 4, 2026

• Make credential identifiers REQUIRED on credential lifecycle events (2.4.1 to 2.4.5)

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 5/5 Over a week Newbie friendliness 30/100

  openid/ssf-wise-profile#38 · 1 comment · Opened Oct 4, 2026

• Make `provenance_uri` REQUIRED on `workload-provenance-changed`

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  Evaluating

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  openid/ssf-wise-profile#37 · 3 comments · Opened Oct 4, 2026

• `workload-degraded` and `workload-restored` express an authorization outcome, not a lifecycle state. Consider removing them

  May be free again @identitymonk claimed this 29 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  researching

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  openid/ssf-wise-profile#34 · 6 comments · 1 assignee · Opened Oct 4, 2026

• Add a `workload-observed` event to mark the start of a workload's lifecycle

  May be free again @identitymonk claimed this 29 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  Draft-04

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  openid/ssf-wise-profile#33 · 2 comments · 1 assignee · Opened Oct 4, 2026

• WISE effective_at claim discrepancy

  May be free again @identitymonk claimed this 29 days ago, and no pull request is open. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  Draft-05

  Difficulty 5/5 Over a week Newbie friendliness 15/100

  openid/ssf-wise-profile#32 · 1 comment · 1 assignee · Opened Oct 3, 2026

• Rework `trust_level` definition and values

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  Draft-04

  Difficulty 5/5 Over a week Newbie friendliness 25/100

  openid/ssf-wise-profile#31 · 5 comments · Opened Sep 28, 2026

• Make `previous_trust_level` a `REQUIRED` field

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  Draft-04

  Difficulty 2/5 1-3 hours Newbie friendliness 68/100

  openid/ssf-wise-profile#30 · 5 comments · Opened Sep 28, 2026

• Rationalization of WISE event

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  Draft-04

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  openid/ssf-wise-profile#29 · 4 comments · Opened Sep 28, 2026

• Register Reason value as urn in a registry

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  Draft-05

  Difficulty 5/5 Over a week Newbie friendliness 30/100

  openid/ssf-wise-profile#28 · Opened Sep 28, 2026

• Better accommodate inbound signals from External Providers (CNAPPs, Posture Evaluators, etc)

  Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  openid/ssf-wise-profile#24 · 2 comments · Opened Jul 29, 2026

• Add `policy_id` to `posture-evaluation-failed` and `posture-evaluation-succeeded`, and add `reason` to `posture-evaluation-succeeded`

  Possibly taken @identitymonk claimed this 22 days ago. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  Evaluating

  Difficulty 5/5 Over a week Newbie friendliness 35/100

  openid/ssf-wise-profile#36 · 1 comment · 1 assignee · Opened Oct 4, 2026

• Combine the three policy-changed events (2.7.1 to 2.7.3) into one `policy-changed` event with a `policy_type` attribute

  Possibly taken @identitymonk claimed this 22 days ago. Open

  ⋯Report a problem with this issue

  • Is something wrong?

  • Already taken
  • Not beginner-friendly
  • Stale or invalid
  • Something else…
  • Send Cancel
  Draft-04

  Difficulty 5/5 Over a week Newbie friendliness 45/100

  openid/ssf-wise-profile#35 · 1 comment · 1 assignee · Opened Oct 4, 2026