[Security Slam 26] Achievement 1 - Cleaner Badge (Security Insights) #10057

The Cleaner badge is the foundational step of the Security Slam 26.

The objective is to provide a "front door" for security auditors and automated tools by creating a standardised SECURITY-INSIGHTS.yml file in the repository root, based on the Security Insights Specification.

This file serves as a machine-readable map of our security practices. It is a critical component for demonstrating our compliance efforts and ensuring that our security posture is easily discoverable by the CNCF and OpenSSF evaluation tools.

Tasks

• Initialise File: Create SECURITY-INSIGHTS.yml in the root of the repository.
• Document Baseline Information:
  • Security Contacts: Clearly define the vulnerability reporting process and contact points.
  • Development Practices: Document current code review and testing protocols.
  • Build and Release: Provide an overview of our build processes.
  • Supply Chain: Document current dependency management and supply chain security practices.
• Validation: Verify that the YAML is well-formed according to the Security Insights specification.
• Apply for the Cleaner badge

Key Principles

• Incremental Development: The file does not need to be exhaustive immediately. We will start with the basic project information and refine it as we progress through the higher Slam tiers.
• Accuracy and Transparency: The documentation must reflect our actual current practices. Providing honest, even if incomplete, information is more valuable to end-users and auditors than linking to unimplemented resources.
• Standardisation: Adhering to this specification allows machines to rapidly verify our security hygiene without manual intervention in the codebase.