[Feature] Security Improvements based on CLOMonitor Checks (kyverno#9395

) * Added Security Insights Signed-off-by: coder12git <[email protected]> * add self-assesssment evidence url Signed-off-by: coder12git <[email protected]> * updated changes Signed-off-by: coder12git <[email protected]> * set bug-bounty to false Signed-off-by: coder12git <[email protected]> --------- Signed-off-by: coder12git <[email protected]> Co-authored-by: Jim Bugwadia <[email protected]>
MariamFahmy98 · Jan 19, 2024 · a045c49 · a045c49
1 parent 5905ab9
commit a045c49
Showing 1 changed file with 62 additions and 0 deletions.
diff --git a/SECURITY-INSIGHTS.yml b/SECURITY-INSIGHTS.yml
@@ -0,0 +1,62 @@
+header:
+  schema-version: 1.0.0
+  expiration-date: '2025-01-15T01:00:00.000Z'
+  project-url: 'https://github.com/kyverno/kyverno'
+  license: 'https://github.com/kyverno/kyverno/blob/main/LICENSE'
+project-lifecycle:
+  bug-fixes-only: false
+  core-maintainers:
+    - https://github.com/kyverno/kyverno/blob/main/MAINTAINERS.md
+  status: active
+  release-process: 'https://github.com/kyverno/kyverno/releases'
+contribution-policy:
+  accepts-pull-requests: true
+  accepts-automated-pull-requests: true
+  automated-tools-list:
+    - automated-tool: dependabot
+      action: allowed
+      path:
+        - /
+  contributing-policy: 'https://github.com/kyverno/kyverno/blob/main/CONTRIBUTING.md'
+  code-of-conduct:
+  - 'https://github.com/kyverno/kyverno/blob/main/CODE_OF_CONDUCT.md'
+documentation:
+  - 'https://kyverno.io/docs/'
+distribution-points:
+  - 'https://github.com/orgs/kyverno/packages'
+security-artifacts:
+  threat-model:
+    threat-model-created: true
+    evidence-url:
+    - 'https://kyverno.io/docs/security/#threat-model'
+  self-assessment:
+    self-assessment-created: true
+    evidence-url:
+    - https://github.com/cncf/tag-security/blob/main/assessments/projects/kyverno/self-assessment.md
+security-testing:
+- tool-type: sca
+  tool-name: Dependabot
+  tool-version: "2"
+  tool-url: https://github.com/dependabot
+  integration:
+    ad-hoc: false
+    ci: true
+    before-release: true 
+security-contacts:
+- type: email
+  value: [email protected]
+  primary: true
+vulnerability-reporting:
+  accepts-vulnerability-reports: true
+  email-contact: [email protected]
+  security-policy: 'https://kyverno.io/docs/security/'
+  bug-bounty-available: false
+  bug-bounty-url: ''
+dependencies:
+  third-party-packages: true
+  dependencies-lists:
+  - 'https://github.com/kyverno/kyverno/blob/main/go.mod'
+  dependencies-lifecycle:
+    policy-url: 'https://kyverno.io/docs/installation/#compatibility-matrix'
+  env-dependencies-policy:
+    policy-url: ''