[Security Review] k8gb

[elohmrow]

Project Name: k8gb

Github URL: https://github.com/k8gb-io/k8gb

CNCF project stage and issue (NA if not applicable): cncf/toc#1472 (incubation)

Security Provider: no

• Identify team
  • Project security lead
  • Lead security reviewer
  • 1 or more additional reviewer(s)
  • Every reviewer has read security reviewer guidelines and stated declaration of conflict
  • Sign off by facilitator on reviewer conflicts
• Create slack channel (e.g. #sec-assess-projectname)
• Project lead provides draft document - see outline
• "Naive question phase" Lead Security Reviewer asks clarifying questions
• Assign issue to security reviewers
• Initial review
• Presentation & discussion
• Share draft findings with project
• Assessment summary and doc checked into /assessments/projects/project-name (require at least 1 co-chair approval)
• CNCF TOC presentation (if requested by TOC)

[eddie-knight]

Hey @elohmrow, I took a look at the application and noticed that the primary need is for a self assessment. Are yall also looking for support via a joint assessment?

[elohmrow]

Hi @eddie-knight - I think it was my misunderstanding of cncf/toc#1472 (comment) . As I now understand things, looks like we only need to do the self-assessment, not the joint assessment for the incubating app.

[eddie-knight]

Brilliant!