Announcing the OpenSSF Vulnerability Disclosure WG guide to disclosure for OSS projects

Authors: Anne Bertucio, Christopher Robinson, David Wheeler, OpenSSF Vulnerability Disclosure WG members

https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md

Vulnerability disclosure is the process of reporting, remediating, and communicating the details of a discovered vulnerability.  This is a critical component of software security both for the software communities that create the code as well as the downstream consumers that ingest and use it. It is so critical in fact, that it was one of the requirements of a recent United States Executive Order on improving software supply chain security. Vulnerability disclosure takes an organized effort on both the software maintainers and security researchers (referred to as “finders”). Within open source projects, this effort typically falls to the project maintainers.

A common saying in the vulnerability disclosure and incident response field is to, “have a plan before you need a plan.” Many open source maintainers have little-to-no familiarity with what a vulnerability disclosure plan should be. Maintainers are experts at creatively solving problems through code, not necessarily at being experts in the area of software security.  While many may have familiarity with secure coding concepts, they have little to no time for creating and drafting a plan for their project. The end result is open source projects without vulnerability disclosure policies, finders without directions on how to report, and users without a clear way to get information on vulnerabilities that may affect them.

Today the OpenSSF is releasing a guide and resources on coordinated vulnerability disclosure (CVD) for open source projects.  This guide was created by the OpenSSF Vulnerability Disclosure Working Group and has been informed by broadly-accepted industry good practices around CVD. The guide takes maintainers through CVD from pre-report preparations to publicly disclosing vulnerabilities, and puts the steps of CVD in the context of open source software development. The guide also includes commonly-needed policy and communication templates, such as a security policy (frequently referred to as a SECURITY.md), embargo notifications, and disclosure announcements. 

The Open Source ecosystem is broad and diverse. While projects may need to modify the resources for their project, the OpenSSF hopes that this encourages project maintainers who are unfamiliar with vulnerability disclosure to learn and adopt CVD for their projects, and simplifies implementation for the disclosure-familiar. These tools and practices can help improve the overall security and awareness of every community that integrates them on whatever level the project can.

This guide borrows the approaches of other open source project disclosure efforts: the Google Guide to CVD for OSS projects, the OpenStack Vulnerability Management Process, and the Kubernetes Security and Disclosure Process. 

This CVD guide is just one of many projects that the Open Source Security Foundation is actively working on to improve security within the OSS ecosystem. The OpenSSF is focused on the incredibly broad spectrum of open source software and seeks to improve the lives of developers, projects, and end-consumers of these fantastic communities.

The guide and resources are available on the OpenSSF GitHub.