[Governance Enhancement] Add Security team

.github/ISSUE_TEMPLATE/distributors-application.md

@@ -0,0 +1,32 @@
+---
+name: Private Disclosure Notification Request
+title: Private disclosure notification request for <YOUR DISTRIBUTION HERE>
+about: Apply for Volcano private distributor notifications
+---
+
+_See [Private distributor notifications](https://github.com/volcano-sh/community/blob/master/security-team/private-distributors-list.md#request-to-join) for additional request details._
+
+## **Please answer the following questions and provide supporting evidence for meeting the [membership criteria](https://github.com/volcano-sh/community/blob/master/security-team/private-distributors-list.md#membership-criteria).**
+
+### 1. **Have an actively monitored security email alias for Volcano security notifications.**
+
+
+### 2. **Serve users outside your own organization, such as users of a Volcano distribution, product, or hosted service.**
+
+
+### 3. **Show a public track record of fixing security issues, such as advisories, CVE fixes, or release notes.**
+
+
+### 4. **Confirm that your distribution is independently maintained and is not only a rebuild of another distribution.**
+
+
+### 5. **Show participation in the Volcano community, such as issues, pull requests, testing, release communication, or community discussion.**
+
+
+### 6. **Accept the [Embargo Policy](https://github.com/volcano-sh/community/blob/master/security-team/private-distributors-list.md#embargo-policy).**
+
+
+### 7. **Be willing to [contribute back](https://github.com/volcano-sh/community/blob/master/security-team/private-distributors-list.md#contributing-back), such as by reviewing fixes, testing patches, or helping with release communication.**
+
+
+### 8. **Have someone already trusted by the Volcano community vouch for the person requesting membership on behalf of your distribution, if requested by the Security Team.**

SECURITY.md

@@ -1,181 +1,12 @@
-# Security Release Process
+# Security Policy
 
-The Volcano project has adopted this security disclosures and response policy
-to ensure responsible handling of critical issues.
+The Volcano security policy and vulnerability response process are maintained by the Volcano Security Team.
 
+Please use the current Security Team documents:
 
-## Product Security Team (PST)
+- Report a vulnerability: [security-team/SECURITY.md](security-team/SECURITY.md#report-a-vulnerability)
+- Security release process: [security-team/security-release-process.md](security-team/security-release-process.md)
+- Security Team and mailing lists: [security-team/security-groups.md](security-team/security-groups.md)
+- Private distributor notifications: [security-team/private-distributors-list.md](security-team/private-distributors-list.md)
 
-Security vulnerabilities should be handled quickly and sometimes privately. The primary goal of this process is to reduce the total time users are vulnerable to publicly known exploits.
-
-The [Product Security Team (PST)](https://github.com/volcano-sh/community/blob/master/PST.md) is responsible for organizing the entire response including internal communication and external disclosure.
-
-The initial Product Security Team will consist of all maintainers in the private [volcano-security](volcano-sig-security@googlegroups.com) list. In the future we may decide to have a subset of maintainers work on security response given that this process is time consuming.
-
-
-## Disclosures
-
-### Private Disclosure Processes
-
-If you find a security vulnerability or any security related issues,
-please DO NOT file a public issue. Do not create a Github issue.
-Instead, send your report privately to [volcano-sig-security@googlegroups.com](volcano-sig-security@googlegroups.com).
-Security reports are greatly appreciated and we will publicly thank you for it.
-
-Please provide as much information as possible, so we can react quickly.
-For instance, that could include:
-- Description of the location and potential impact of the vulnerability;
-- A detailed description of the steps required to reproduce the vulnerability (POC scripts, screenshots, and compressed packet captures are all helpful to us)
-- Whatever else you think we might need to identify the source of this vulnerability
-
-### Public Disclosure Processes
-
-If you know of a publicly disclosed security vulnerability please IMMEDIATELY email [volcano-sig-security@googlegroups.com](volcano-sig-security@googlegroups.com)
-to inform the Product Security Team (PST) about the vulnerability so we start the patch, release, and communication process.
-
-If possible the PST will ask the person making the public report if the issue can be handled via a private disclosure process
-(for example if the full exploit details have not yet been published).
-If the reporter denies the request for private disclosure, the PST will move swiftly with the fix and release process.
-In extreme cases you can ask GitHub to delete the issue but this generally isn't necessary and is unlikely to make a public disclosure less damaging.
-
-## Patch, Release, and Public Communication
-
-For each vulnerability a member of the PST will volunteer to lead coordination with the "Fix Team"
-and is responsible for sending disclosure emails to the rest of the community.
-This lead will be referred to as the "Fix Lead."
-
-The role of Fix Lead should rotate round-robin across the PST.
-
-Note that given the current size of the Volcano community it is likely that the PST is the same as the "Fix team."
-The PST may decide to bring in additional contributors for added expertise depending on the area of the code that contains the vulnerability.
-
-All of the timelines below are suggestions and assume a Private Disclosure.
-If the Team is dealing with a Public Disclosure all timelines become ASAP.
-If the fix relies on another upstream project's disclosure timeline, that will adjust the process as well.
-We will work with the upstream project to fit their timeline and best protect our users.
-
-### Fix Team Organization
-
-These steps should be completed within the first 24 hours of disclosure.
-
-- The Fix Lead will work quickly to identify relevant engineers from the affected projects and
-  packages and CC those engineers into the disclosure thread. These selected developers are the Fix
-  Team.
-- The Fix Lead will get the Fix Team access to private security repos to develop the fix.
-
-
-### Fix Development Process
-
-These steps should be completed within the 1-7 days of Disclosure.
-
-- The Fix Lead and the Fix Team will create a
-  [CVSS](https://www.first.org/cvss/specification-document) using the [CVSS
-  Calculator](https://www.first.org/cvss/calculator/3.0). The Fix Lead makes the final call on the
-  calculated CVSS; it is better to move quickly than making the CVSS perfect.
-- The Fix Team will notify the Fix Lead that work on the fix branch is complete once there are LGTMs
-  on all commits in the private repo from one or more maintainers.
-
-If the CVSS score is under 4.0 ([a low severity
-score](https://www.first.org/cvss/specification-document#i5)) the Fix Team can decide to slow the
-release process down in the face of holidays, developer bandwidth, etc. These decisions must be
-discussed on the volcano-security mailing list.
-
-### Fix Disclosure Process
-
-With the Fix Development underway the Volcano Security Team needs to come up with an overall communication plan for the wider community.
-This Disclosure process should begin after the Team has developed a fix or mitigation
-so that a realistic timeline can be communicated to users.
-
-**Disclosure of Forthcoming Fix to Users** (Completed within 1-7 days of Disclosure)
-
-- The Fix Lead will create a github issue in Volcano project to inform users that a security vulnerability
-has been disclosed and that a fix will be made available, with an estimation of the Release Date.
-It will include any mitigating steps users can take until a fix is available.
-
-The communication to users should be actionable.
-They should know when to block time to apply patches, understand exact mitigation steps, etc.
-
-**Optional Fix Disclosure to Private Distributors List** (Completed within 1-14 days of Disclosure):
-
-- The Fix Lead will make a determination with the help of the Fix Team if an issue is critical enough to require early disclosure to distributors.
-Generally this Private Distributor Disclosure process should be reserved for remotely exploitable or privilege escalation issues.
-Otherwise, this process can be skipped.
-- The Fix Lead will email the patches to volcano-distributors-announce@lists.cncf.io so distributors can prepare their own release to be available to users on the day of the issue's announcement.
-Distributors should read about the [Private Distributor List](#private-distributor-list) to find out the requirements for being added to this list.
-- **What if a distributor breaks embargo?** The PST will assess the damage and may make the call to release earlier or continue with the plan.
-When in doubt push forward and go public ASAP.
-
-**Fix Release Day** (Completed within 1-21 days of Disclosure)
-
-- the Fix Team will selectively choose all needed commits from the Master branch in order to create a new release on top of the current last version released.
-- Release process will be as usual.
-- The Fix Lead will request a CVE from [DWF](https://github.com/distributedweaknessfiling/DWF-Documentation)
-  and include the CVSS and release details.
-- The Fix Lead will inform all users, devs and integrators, now that everything is public,
-  announcing the new releases, the CVE number, and the relevant merged PRs to get wide distribution
-  and user action. As much as possible this email should be actionable and include links on how to apply
-  the fix to user's environments; this can include links to external distributor documentation.
-
-
-## Private Distributor List
-
-This list is intended to be used primarily to provide actionable information to
-multiple distributor projects at once. This list is not intended for
-individuals to find out about security issues.
-
-### Embargo Policy
-
-The information members receive on volcano-distributors-announce@lists.cncf.io must not be
-made public, shared, nor even hinted at anywhere beyond the need-to-know within
-your specific team except with the list's explicit approval.
-This holds true until the public disclosure date/time that was agreed upon by the list.
-Members of the list and others may not use the information for anything other
-than getting the issue fixed for your respective distribution's users.
-
-Before any information from the list is shared with respective members of your
-team required to fix said issue, they must agree to the same terms and only
-find out information on a need-to-know basis.
-
-In the unfortunate event you share the information beyond what is allowed by this policy, you must urgently inform the volcano-sig-security@googlegroups.com mailing list of exactly what information leaked and to whom. A retrospective will take place after the leak so we can assess how to prevent making the same mistake in the future.
-
-If you continue to leak information and break the policy outlined here, you
-will be removed from the list.
-
-### Contributing Back
-
-This is a team effort. As a member of the list you must carry some water. This
-could be in the form of the following:
-
-**Technical**
-
-- Review and/or test the proposed patches and point out potential issues with
-  them (such as incomplete fixes for the originally reported issues, additional
-  issues you might notice, and newly introduced bugs), and inform the list of the
-  work done even if no issues were encountered.
-
-**Administrative**
-
-- Help draft emails to the public disclosure mailing list.
-- Help with release notes.
-
-### Membership Criteria
-
-To be eligible for the volcano-distributors-announce@lists.cncf.io mailing list, your
-distribution should:
-
-1. Be an active distributor of Volcano.
-2. Have a user base not limited to your own organization.
-3. Have a publicly verifiable track record up to present day of fixing security
-   issues.
-4. Not be a downstream or rebuild of another distributor.
-5. Be a participant and active contributor in the community.
-6. Accept the [Embargo Policy](#embargo-policy) that is outlined above.
-7. Have someone already on the list vouch for the person requesting membership
-   on behalf of your distribution.
-
-### Requesting to Join
-
-New membership requests are sent to volcano-sig-security@googlegroups.com.
-
-In the body of your request please specify how you qualify and fulfill each
-criterion listed in [Membership Criteria](#membership-criteria).
+Do not file public GitHub issues for suspected security vulnerabilities. Report them privately to [volcano-security@googlegroups.com](mailto:volcano-security@googlegroups.com).

compliance.md

@@ -528,7 +528,7 @@ See [license-lint](https://github.com/volcano-sh/volcano/tree/master/config/lice
 
 ### Expectations 
 
-License compliance matters are the responsibility of the [PST](https://github.com/volcano-sh/community/blob/master/PST.md) team. They should be responsible for license selection, review and compliance risk avoidance. They should take corresponding responsibilities to ensure that the licenses introduced by the community comply with open source compliance specifications, and make timely corrections when there are compliance risks. For example, for contagious licenses such as GPL licenses, relevant open source obligations should be fully fulfilled in open source software compliance projects,  SBOM and source code should be provided in projects, and they should also consider alternative license options to avoid  legal risks .Characters who do not comply with the above behavior can be removed and re-elected.
+License compliance matters are handled by the community maintainers and compliance reviewers listed above, with security-sensitive compliance risks coordinated with the [Security Team](https://github.com/volcano-sh/community/blob/master/security-team/security-groups.md#the-security-team) when needed. They should be responsible for license selection, review and compliance risk avoidance. They should take corresponding responsibilities to ensure that the licenses introduced by the community comply with open source compliance specifications, and make timely corrections when there are compliance risks. For example, for contagious licenses such as GPL licenses, relevant open source obligations should be fully fulfilled in open source software compliance projects, SBOM and source code should be provided in projects, and they should also consider alternative license options to avoid legal risks. Contributors who do not comply with the above behavior can be removed and re-elected.
 
 ## Contact
 
@@ -537,4 +537,3 @@ If you have any questions about open source license compliance, please contact u
 [Volcano Slack Channel](https://cloud-native.slack.com/archives/C011GJDQS0N) | [Join](https://slack.cncf.io/)
 
 [Mailing List](https://groups.google.com/forum/#!forum/volcano-sh)
-

security-team/README.md

@@ -0,0 +1,18 @@
+# Security Team
+
+The Volcano Security Team is responsible for receiving, triaging, and coordinating the response to reports of security issues in Volcano projects.
+
+## Contact
+
+- Private security mailing list: [volcano-security@googlegroups.com](mailto:volcano-security@googlegroups.com)
+- Community issues: [volcano-sh/community issues](https://github.com/volcano-sh/community/issues)
+
+Suspected vulnerabilities must not be reported through public GitHub issues. Please follow the private reporting process in [SECURITY.md](SECURITY.md#report-a-vulnerability).
+
+## Security Process
+
+The Volcano security policy is documented in [SECURITY.md](SECURITY.md), including the vulnerability reporting process and supported version policy. Vulnerability response and disclosure are handled through the [security release process](security-release-process.md).
+
+Security Team membership and security mailing lists are maintained in [security-groups.md](security-groups.md). Private distributor notifications are documented in [private-distributors-list.md](private-distributors-list.md). Repository and security response access controls are documented in [access-control.md](access-control.md).
+
+Security assessment material is maintained under [assessments](assessments), including the [security self-assessment](assessments/self-assessment.md).