We use analytics and cookies to understand site traffic. Information about your use of our site is shared with Google for that purpose. Learn more.
Early Disclosure of Security Vulnerabilities
(This policy is based on the Istio Early Disclosure Policy).
Knative follows the process described in responding when security vulnerabilities are reported.
The Knative project maintains a mailing list for private early disclosure of security vulnerabilities. The list is used to provide actionable information to close Knative partners. The list is NOT intended for individuals to find out about security issues.
Knative has upstream dependencies of its own. In certain situations, we may need to make emergency Knative releases to address vulnerabilities in these upstream dependencies. Due to embargo policies of these dependencies, we may not be allowed to share any details about the vulnerabilities. In that case, Knative’s early disclosure will be strictly focused on the mechanics of an upcoming patch release, rather than on the details of the discovered vulnerabilities.
The information members receive from the mailing list must not be made public, shared, nor even hinted at anywhere beyond the need-to-know within your specific team except with the list’s explicit approval. This holds true until the public disclosure date/time that was agreed upon by the list. Members of the list and others may not use the information for anything other than getting the issue fixed for your respective distribution’s users.
Before any information from the list is shared with respective members of your team required to fix said issue, they must agree to the same terms and only find out information on a need-to-know basis.
In the unfortunate event you share the information beyond what is allowed by this policy, you must urgently inform the mailing list by replying to the initial disclosure email. The email should specify exactly what information leaked and to whom. A retrospective will take place after the leak so we can assess how to not make the same mistake in the future.
If you continue to leak information and break the policy outlined here, you will be removed from the early disclosure list.
To be eligible for the early disclosure mailing list, your organization must:
- Have an actively monitored security email alias for our project. This cannot be a personal email address, it must be a corporate address owned by the organization.
- Be involved in redistributing Knative or have a product with close coupling to Knative.
- Have a user base not limited to your own organization.
- Be a participant and active contributor in the Knative community.
- Accept the Embargo Policy that is outlined above.
Removal: If your organization stops meeting one or more of these criteria after joining the list then you will be unsubscribed.
Request to join
New membership requests should be emailed to firstname.lastname@example.org.
In the body of your email please specify how you qualify and fulfill each criterion listed in Membership criteria.
Here is an example:
To: email@example.com Subject: Seven-Corp Membership to Early Disclosure Mailing List Below are each criterion and why I think we, Seven-Corp, qualify. > 1. Have an actively monitored security alias email for our project. Yes, please subscribe firstname.lastname@example.org to the early disclosure list. > 2. Be involved in redistributing Knative or have a product with close coupling to Knative. We distribute the "Seven" distribution of knative [link]. We have been doing this since 2017. > 3. Have a user base not limited to your own organization. Our user base spans of the extensive "Seven" community. We have a slack and GitHub repos and mailing lists where the community hangs out. [links] > 4. Be a participant and active contributor in the Knative community. Our members, Acidburn, Cereal, and ZeroCool are outstanding members and are well known throughout the Knative community. Especially for their contributions in hacking the Gibson. > 5. Accept the Embargo Policy that is outlined above. We accept.