Vulnerability reporting

[pahmann]

What

How do we handle reporting of vulnerability with a private reporting to not having an extra level of exposure?

Acceptance Criteria (DoD)

Defined how to report vulnerabilities privately.

How

No response

[pahmann]

Is there maybe something directly from Eclipse which we can use?

[masc2023]

Yes, did you check already here?
https://eclipse-score.github.io/score/main/platform_management_plan/vulnerability_management.html

Also includes many links to Eclipse and https://www.eclipse.org/security/policy/