Hi all,

There were some good talks at the Vancouver Summit about the kind of security work the Kata community should be doing. An easy one to cherry pick is having an easily discoverable vulnerability disclosure contact and a public process for how those are handled. 

In regards to process, an easy place to start would be the OpenStack VMT process[1], and using their assistance to make it applicable to how we work in Kata (specifics are strongly tied to the OpenStack project process right now, but the general process is still applicable to us). 


Are there people in our community who want to champion this and start up our vulnerability management team?

[1] https://security.openstack.org/vmt-process.html 

Anne Bertucio
OpenStack Foundation
anne@openstack.org | irc: annabelleB