+
+## Supply-chain
+
+**Description:** Attackers can obtain the control of a third-party sources (e.g. website domain, server, etc) linked in the `SECURITY-INSIGHTS.yml`.
+
+**Mitigation:** Maintainers could self-host the evidence to reduce risks.
+
+## False information in the SECURITY-INSIGHTS.yml
+
+**Description:** Maintainers could upload false information in the `SECURITY-INSIGHTS.yml` just to obtain a high score from the scanners or other services which use SECURITY-INSIGHTS to evaluate the project.
+
+**Mitigation:** Scanners could introduce some additional checks (e.g. check if URLs return 200 OK status) and a weighted score to reduce the risks. In addition, the open-source community can read the YAML file and report false information (or just information without clear evidence).
+
+## Private information sharing
+
+**Description:** A maintainer shares mistakenly private critical information (e.g. security audit containing unpatched vulnerabilities).
+
+**Mitigation:** No mitigation provided yet.
+
+## Malicious pull-request
+
+**Description:** A malicious contributor could introduce false or malicious information (e.g. malicious URLs) to obtain a particular advantage.
+
+**Mitigation:** The contributors' PRs to `SECURITY-INSIGHTS.yml` should be carefully reviewed and approved by the maintainers. In addition, the maintainers could decide to not accept direct contributions to the `SECURITY-INSIGHTS.yml`.
+
+## Missing pull-request review or lacks in the review process
+
+**Description:** Missing PR review or lack in the review process can lead to the tampering of `SECURITY-INSIGHTS.yml` by adding false information.
+
+**Mitigation:** The PR should be formally reviewed and approved by another maintainer.
\ No newline at end of file
diff --git a/website/content/docs/introduction/tooling.md b/website/content/docs/introduction/tooling.md
new file mode 100644
index 0000000..7b436d9
--- /dev/null
+++ b/website/content/docs/introduction/tooling.md
@@ -0,0 +1,26 @@
+---
+title: "Tooling"
+description: "Tools and solutions to manage the SECURITY-INSIGHTS YAML."
+summary: ""
+draft: false
+menu:
+ docs:
+ parent: "introduction"
+weight: 13000
+toc: true
+seo:
+ title: "" # custom title (optional)
+ description: "" # custom description (recommended)
+ canonical: "" # custom canonical URL (optional)
+ noindex: false # false (default) or true
+---
+
+The Metrics and Metadata Working Group actively develop and maintain some open-sourse tools and solutions to generate and verify the SECURITY-INSIGHTS YAML (`SECURITY-INSIGHTS.yml`).
+
+## SECURITY-INSIGHTS Validator Docker image
+
+Maintainers and contributors can easily verify a SECURITY-INSIGHTS YAML file using the Docker image [security-insights-validator](https://hub.docker.com/r/luigigubello/security-insights-validator), downloadable directly from DockerHub. Alternatively, they can launch the Dockerfile from the folder `python` in the repository [ossf/si-tooling](https://github.com/ossf/si-tooling).
+
+## SECURITY-INSIGHTS GitHub Action
+
+Maintainers can easily integrate the verification of the SECURITY-INSIGHTS files into their GitHub workflows by using the GitHub Action [SECURITY-INSIGHTS Validator](https://github.com/luigigubello/security-insights-validator-ga). This GitHub Action is based on the Docker image released in the OpenSSF repository [ossf/si-tooling/python](https://github.com/ossf/si-tooling/tree/main/python).
\ No newline at end of file
diff --git a/website/content/docs/introduction/user-stories.md b/website/content/docs/introduction/user-stories.md
new file mode 100644
index 0000000..775a9ce
--- /dev/null
+++ b/website/content/docs/introduction/user-stories.md
@@ -0,0 +1,82 @@
+---
+title: "Users Stories"
+description: "How the community, the developers, and the consumers can use SECURITY INSIGHTS specification."
+summary: ""
+draft: false
+menu:
+ docs:
+ parent: "introduction"
+weight: 12000
+toc: true
+seo:
+ title: "" # custom title (optional)
+ description: "" # custom description (recommended)
+ canonical: "" # custom canonical URL (optional)
+ noindex: false # false (default) or true
+---
+
+## Why must this specification exist?
+
+### Introduction
+
+Security is important, for this reason, many potential users (final users, engineers,
+developers, or companies) might want to evaluate the security of a particular
+open-source project. There are many ways to evaluate the security of a project,
+including evaluating the code itself (statically or dynamically), the processes used,
+and/or the people involved (e.g., whether or not they know how to develop secure
+software).
+
+Some information can be determined automatically by tools, but determining
+information via tools is often imperfect. For example, many would want to know if a
+project uses an automated test suite, yet because there are so many different kinds
+of test suites & ways to invoke them, automated tools often fail to correctly
+identify whether or not automated tests are performed. It can be provided manually,
+but that must be done for each approach.
+
+This specification provides a mechanism for projects to report information about
+their security in a machine-processable way. It is formatted as a YAML file to make
+it easy to read and edit directly by people. It is expected that a first draft of the
+file would be created by automated tools, "wizards" that guide users through the
+answers, and linter tools that help users to check the YAML file schema. The file is
+then put under version control, provided to potential users, and updated as needed.
+The file's contents may then be extracted for a variety of different reasons (e.g.,
+extracted into security evaluations, etc.).
+
+This is an early version created by the OpenSSF Identifying Security Threats Working
+Group. See the [OpenSSF Community Calendar](https://calendar.google.com/calendar?cid=czYzdm9lZmhwNWk5cGZsdGI1cTY3bmdwZXNAZ3JvdXAuY2FsZW5kYXIuZ29vZ2xlLmNvbQ).
+
+### SECURITY-INSIGHTS.yml
+
+> *"How much can tools trust this file?"*
+
+That is an issue in the end decided by the tools that read this data.
+
+The minimum viable product (MVP) should provide the following information:
+
+- Procedure to report a vulnerability (security contact, Vulnerability Disclosure Policy (VDP));
+- Owners contacts.
+
+This format records assertions made by a project itself. These assertions may be
+obsolete or even maliciously false. Still, it provides additional information that
+otherwise would not be automatically accessible. Humans and tools that evaluate
+projects may want to report results both including and not including self-assertions,
+or assertions unverified by a trusted third party.
+
+### User Stories
+
+**SECURITY-INSIGHTS.yml** would like to solve the following user stories by helping
+the maintainers to improve the security of their projects and the final users (e.g.
+developers, companies, automated scanners, etc) to better evaluate the security of
+third-party software.
+
+| AS A/AN | I WANT TO | SO THAT |
+|---|---|---|
+| developer of an automated tool | have a standard machine-readable file containing security information about the project | I can scan it to reduce false-positive results |
+| security researcher | report a potential vulnerability | the project's maintainers may be aware of it |
+| user | know which tools are used to lint or scan the code, and which are the security processes in place | I can evaluate the security best practices followed by the project |
+| maintainer | know which free tools (better open-source) I can use to lint or scan the code and the dependencies | I can reduce risks related to supply-chain attacks or human errors |
+| user | know what are the trusted sources for this project | I can read, download or install only trusted code |
+| user | know project status, release cycle time, security maintenance, and project end of life | I can schedule ordinary and extraordinary maintenance |
+| maintainer | receive reports related only to certain types of vulnerabilities | I can work on more urgent features and fixes instead of reading out-of-scope reports |
+| user | contact the project maintainers for general questions | I can solve my issues |
+| user | read a security policy | I can easily know security practices in place |
diff --git a/website/content/docs/specification/_index.md b/website/content/docs/specification/_index.md
new file mode 100644
index 0000000..865eebb
--- /dev/null
+++ b/website/content/docs/specification/_index.md
@@ -0,0 +1,17 @@
+---
+title: "Specification"
+description: ""
+summary: ""
+draft: false
+menu:
+ docs:
+ parent: ""
+ identifier: "specification"
+weight: 20000
+toc: true
+seo:
+ title: "" # custom title (optional)
+ description: "" # custom description (recommended)
+ canonical: "" # custom canonical URL (optional)
+ noindex: false # false (default) or true
+---
\ No newline at end of file
diff --git a/website/content/docs/specification/schema.md b/website/content/docs/specification/schema.md
new file mode 100644
index 0000000..ee59659
--- /dev/null
+++ b/website/content/docs/specification/schema.md
@@ -0,0 +1,717 @@
+---
+title: "SECURITY INSIGHTS YAML Schema v1.1.0"
+description: "YAML Schema for SECURITY INSIGHTS 1.1.0."
+summary: ""
+draft: false
+menu:
+ docs:
+ parent: "specification"
+weight: 22000
+toc: true
+seo:
+ title: "" # custom title (optional)
+ description: "" # custom description (recommended)
+ canonical: "" # custom canonical URL (optional)
+ noindex: false # false (default) or true
+
+---
+
+In this page you can find the YAML schema for SECURITY INSIGHTS Specification 1.1.0.
+
+```yaml
+$schema: http://json-schema.org/draft-07/schema
+title: Security Insights Version 1.0.0 YAML Schema
+additionalProperties: false
+description: YAML schema for security-insights.yml
+properties:
+ header:
+ $id: '#/properties/header'
+ additionalProperties: false
+ properties:
+ schema-version:
+ $id: '#/properties/header/properties/schema-version'
+ description: 'Version of the SECURITY-INSIGHTS YAML Schema.'
+ type: string
+ enum: ['1.0.0']
+ expiration-date:
+ $id: '#/properties/header/properties/expiration-date'
+ description: 'Expiration date for the SECURITY-INSIGHTS.yml. At most a year later the `last-reviewed` date.'
+ type: string
+ format: date-time
+ last-updated:
+ $id: '#/properties/header/properties/last-updated'
+ description: 'Last time the SECURITY-INSIGHTS.yml was updated, excluding the properties `commit-hash` and `last-reviewed`.'
+ type: string
+ format: date
+ last-reviewed:
+ $id: '#/properties/header/properties/last-reviewed'
+ description: 'Last time the SECURITY-INSIGHTS.yml was reviewed. Updating this property requires updating the property `commit-hash`.'
+ type: string
+ format: date
+ commit-hash:
+ $id: '#/properties/header/properties/commit-hash'
+ description: 'The last commit to which the SECURITY-INSIGHTS.yml refers.'
+ type: string
+ pattern: '^\b[0-9a-f]{5,40}\b$'
+ project-url:
+ $id: '#/properties/header/properties/project-url'
+ description: 'Link to the open-source project.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ project-release:
+ $id: '#/properties/header/properties/project-release'
+ description: 'Release version to which the SECURITY-INSIGHTS.yml refers.'
+ type: string
+ changelog:
+ $id: '#/properties/header/properties/changelog'
+ description: 'Link to the project changelog.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ license:
+ $id: '#/properties/header/properties/license'
+ description: 'Link to the project license.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ required:
+ - expiration-date
+ - project-url
+ - schema-version
+ type: object
+ project-lifecycle:
+ $id: '#/properties/project-lifecycle'
+ additionalProperties: false
+ properties:
+ bug-fixes-only:
+ $id: '#/properties/project-lifecycle/properties/bug-fixes-only'
+ description: 'Maintainers fix bugs without implementing new features. The project is in Maintenance Mode.'
+ type: boolean
+ core-maintainers:
+ $id: '#/properties/project-lifecycle/properties/core-maintainers'
+ description: |
+ [Deprecation notice] `core-maintainers` will be deprecated in the next versions.
+ Maintainers contacts (e-mail, Twitter, etc).
+ additionalItems: false
+ items:
+ $id: '#/properties/project-lifecycle/properties/core-maintainers/items'
+ anyOf:
+ - $id: '#/properties/project-lifecycle/properties/core-maintainers/items/anyOf/0'
+ type: string
+ type: array
+ uniqueItems: true
+ core-team:
+ $id: '#/properties/project-lifecycle/properties/core-team'
+ description: |
+ Maintainers or team contacts (e-mail, Mastodon, Discord, web pages, etc).
+ Each core team member must have either a contact or a URI to a document or webpage.
+ additionalItems: false
+ items:
+ $id: '#/properties/project-lifecycle/properties/core-team/items'
+ anyOf:
+ - $id: '#/properties/project-lifecycle/properties/core-team/items'
+ additionalProperties: false
+ properties:
+ name:
+ $id: '#/properties/project-lifecycle/properties/core-team/items/anyOf/0/properties/name'
+ description: 'The name of the team or maintainer.'
+ type: string
+ role:
+ $id: '#/properties/project-lifecycle/properties/core-team/items/anyOf/0/properties/role'
+ description: 'Description of the role of the team or maintainer.'
+ type: string
+ contact:
+ $id: '#/properties/project-lifecycle/properties/core-team/items/anyOf/0/properties/contact'
+ description: 'Maintainers contacts (e-mail, Twitter, etc), required if "uri" is not present.'
+ type: string
+ uri:
+ $id: '#/properties/project-lifecycle/properties/core-team/items/anyOf/0/properties/uri'
+ description: 'URI to a team document (e.g. team member page), required if "contact" is not present.'
+ type: string
+ oneOf:
+ - required:
+ - contact
+ - required:
+ - uri
+ type: array
+ uniqueItems: true
+ roadmap:
+ $id: '#/properties/project-lifecycle/properties/roadmap'
+ description: 'Link to the project roadmap.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ release-cycle:
+ $id: '#/properties/project-lifecycle/properties/release-cycle'
+ description: 'Link to the project release cycle.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ release-process:
+ $id: '#/properties/project-lifecycle/properties/release-process'
+ description: 'Shortly describe the release process. Maximum length 560 chars.'
+ type: string
+ pattern: '^(.|\n){1,560}$'
+ status:
+ $id: '#/properties/project-lifecycle/properties/status'
+ description: 'Define if the project is still active or not.'
+ type: string
+ enum: ['active', 'inactive', 'concept', 'wip', 'suspended', 'abandoned', 'unsupported', 'moved']
+ if:
+ properties:
+ status:
+ const: "active"
+ then:
+ required:
+ - core-team
+ else:
+ if:
+ properties:
+ bug-fixes-only:
+ const: true
+ then:
+ required:
+ - core-team
+ required:
+ - status
+ - bug-fixes-only
+ type: object
+ contribution-policy:
+ $id: '#/properties/contribution-policy'
+ additionalProperties: false
+ properties:
+ accepts-pull-requests:
+ $id: '#/properties/contribution-policy/properties/accepts-pull-requests'
+ description: 'Define if the maintainers accept pull-requests or not from external contributors.'
+ type: boolean
+ accepts-automated-pull-requests:
+ $id: '#/properties/contribution-policy/properties/accepts-automated-pull-requests'
+ description: 'Define if the maintainers accept pull-requests generated by bots or automated tools.'
+ type: boolean
+ automated-tools-list:
+ $id: '#/properties/contribution-policy/properties/automated-tools-list'
+ description: 'List of allowed and denied bots. This property can overwrite `accepts-automated-pull-requests`.'
+ additionalItems: false
+ items:
+ anyOf:
+ - $id: '#/properties/contribution-policy/properties/automated-tools-list/items'
+ additionalProperties: false
+ properties:
+ automated-tool:
+ $id: '#/properties/contribution-policy/items/anyOf/0/properties/automated-tool'
+ description: 'Automated tool or bot name.'
+ type: string
+ action:
+ $id: '#/properties/contribution-policy/items/anyOf/0/properties/action'
+ description: 'Define if automated actions are allowed or denied.'
+ type: string
+ enum: ['allowed', 'denied']
+ path:
+ $id: '#/properties/contribution-policy/items/anyOf/0/properties/path'
+ description: 'Define sub-paths where the automated actions are allowed or denied.'
+ additionalItems: false
+ items:
+ $id: '#/properties/contribution-policy/items/anyOf/0/properties/path/items'
+ anyOf:
+ - $id: '#/properties/contribution-policy/items/anyOf/0/properties/path/items/anyOf/0'
+ description: 'Project sub-path.'
+ type: string
+ type: array
+ uniqueItems: true
+ comment:
+ $id: '#/properties/contribution-policy/items/anyOf/0/properties/comment'
+ description: 'Short comment.'
+ type: string
+ pattern: '^(.|\n){1,560}$'
+ required:
+ - automated-tool
+ - action
+ type: object
+ type: array
+ uniqueItems: true
+ contributing-policy:
+ $id: '#/properties/contribution-policy/properties/contributing-policy'
+ description: 'Link to the contributing policy.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ code-of-conduct:
+ $id: '#/properties/contribution-policy/properties/code-of-conduct'
+ description: 'Link to the project code of conduct.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ required:
+ - accepts-pull-requests
+ - accepts-automated-pull-requests
+ type: object
+ documentation:
+ $id: '#/properties/documentation'
+ additionalItems: false
+ items:
+ $id: '#/properties/documentation/items'
+ anyOf:
+ - $id: '#/properties/documentation/items/anyOf/0'
+ description: 'Link to the project documentation.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ type: array
+ uniqueItems: true
+ distribution-points:
+ $id: '#/properties/distribution-points'
+ additionalItems: false
+ items:
+ $id: '#/properties/distribution-points/items'
+ anyOf:
+ - $id: '#/properties/distribution-points/items/anyOf/0'
+ description: 'Link (PURL/URL) to the package.'
+ type: string
+ type: array
+ uniqueItems: true
+ security-artifacts:
+ $id: '#/properties/security-artifacts'
+ additionalProperties: false
+ properties:
+ threat-model:
+ $id: '#/properties/security-artifacts/properties/threat-model'
+ additionalProperties: false
+ properties:
+ threat-model-created:
+ $id: '#/properties/security-artifacts/properties/threat-model/properties/threat-model-created'
+ description: 'Define if the threat model for the project has been created.'
+ type: boolean
+ evidence-url:
+ $id: '#/properties/security-artifacts/properties/threat-model/properties/evidence-url'
+ additionalItems: false
+ items:
+ $id: '#/properties/security-artifacts/properties/threat-model/properties/evidence-url/items'
+ anyOf:
+ - $id: '#/properties/security-artifacts/properties/threat-model/properties/evidence-url/items/anyOf/0'
+ description: 'Link to the evidence of the threat model.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ type: array
+ uniqueItems: true
+ comment:
+ $id: '#/properties/security-artifacts/properties/threat-model/properties/comment'
+ description: 'Additional comment to describe the threat models, giving more context. Maximum length 560 chars.'
+ type: string
+ pattern: '^(.|\n){1,560}$'
+ if:
+ properties:
+ threat-model-created:
+ const: true
+ then:
+ required:
+ - evidence-url
+ required:
+ - threat-model-created
+ type: object
+ self-assessment:
+ $id: '#/properties/security-artifacts/properties/self-assessment'
+ additionalProperties: false
+ properties:
+ self-assessment-created:
+ $id: '#/properties/security-artifacts/properties/self-assessment/properties/self-assessment-created'
+ description: 'Define whether a security self assessment for the project has been created. A false value may be used to add comments regarding the status of the assessment.'
+ type: boolean
+ evidence-url:
+ $id: '#/properties/security-artifacts/properties/self-assessment/properties/evidence-url'
+ additionalItems: false
+ items:
+ $id: '#/properties/security-artifacts/properties/self-assessment/properties/evidence-url/items'
+ anyOf:
+ - $id: '#/properties/security-artifacts/properties/self-assessment/properties/evidence-url/items/anyOf/0'
+ description: 'Link to the evidence of the security self assessment.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ type: array
+ uniqueItems: true
+ comment:
+ $id: '#/properties/security-artifacts/properties/self-assessment/properties/comment'
+ description: 'Additional context regarding the security self assessment or its status. Maximum length 560 chars.'
+ type: string
+ pattern: '^(.|\n){1,560}$'
+ if:
+ properties:
+ self-assessment-created:
+ const: true
+ then:
+ required:
+ - evidence-url
+ required:
+ - self-assessment-created
+ type: object
+ other-artifacts:
+ $id: '#/properties/security-artifacts/properties/other-artifacts'
+ anyOf:
+ - $id: '#/properties/security-testing/items/anyOf/0'
+ additionalProperties: false
+ properties:
+ artifact-name:
+ $id: '#/properties/security-artifacts/properties/other-artifacts/anyOf/0/properties/name'
+ description: 'Name of the security artifact.'
+ type: string
+ artifact-created:
+ $id: '#/properties/security-artifacts/properties/other-artifacts/anyOf/0/properties/artifact-created'
+ description: 'Define whether this artifact has been created. A false value may be used to add comments regarding the status of the artifact.'
+ type: boolean
+ evidence-url:
+ $id: '#/properties/security-artifacts/properties/other-artifacts/anyOf/0/properties/evidence-url'
+ additionalItems: false
+ items:
+ $id: '#/properties/security-artifacts/properties/other-artifacts/anyOf/0/properties/evidence-url/items'
+ anyOf:
+ - $id: '#/properties/security-artifacts/properties/other-artifacts/anyOf/0/properties/evidence-url/items/anyOf/0'
+ description: 'Link to the evidence of the security artifact.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ type: array
+ uniqueItems: true
+ comment:
+ $id: '#/properties/security-artifacts/properties/self-assessment/anyOf/0/properties/comment'
+ description: 'Additional context regarding the security artifact or its status. Maximum length 560 chars.'
+ type: string
+ pattern: '^(.|\n){1,560}$'
+ if:
+ properties:
+ artifact-created:
+ const: true
+ then:
+ required:
+ - evidence-url
+ type: array
+ type: object
+ security-testing:
+ $id: '#/properties/security-testing'
+ additionalItems: false
+ items:
+ $id: '#/properties/security-testing/items'
+ anyOf:
+ - $id: '#/properties/security-testing/items/anyOf/0'
+ additionalProperties: false
+ properties:
+ integration:
+ $id: '#/properties/security-testing/items/anyOf/0/properties/integration'
+ additionalProperties: false
+ properties:
+ ad-hoc:
+ $id: '#/properties/security-testing/items/anyOf/0/properties/integration/properties/ad-hoc'
+ description: 'Define if the test is an ad-hoc security test.'
+ type: boolean
+ before-release:
+ $id: '#/properties/security-testing/items/anyOf/0/properties/integration/properties/before-release'
+ description: 'Define if the security test runs before the release.'
+ type: boolean
+ ci:
+ $id: '#/properties/security-testing/items/anyOf/0/properties/integration/properties/ci'
+ description: 'Define if the security test is part of the CI.'
+ type: boolean
+ required:
+ - ad-hoc
+ - ci
+ - before-release
+ type: object
+ tool-name:
+ $id: '#/properties/security-testing/items/anyOf/0/properties/tool-name'
+ description: 'Name of the tool used to scan or analyze the project.'
+ type: string
+ tool-rulesets:
+ $id: '#/properties/security-testing/items/anyOf/0/properties/tool-rulesets'
+ additionalItems: false
+ items:
+ $id: '#/properties/security-testing/items/anyOf/0/properties/tool-rulesets/items'
+ anyOf:
+ - $id: '#/properties/security-testing/items/anyOf/0/properties/tool-rulesets/items/anyOf/0'
+ description: 'Tool rules used to scan or analyze the project.'
+ type: string
+ type: array
+ uniqueItems: true
+ tool-type:
+ $id: '#/properties/security-testing/items/anyOf/0/properties/tool-type'
+ description: 'Type of security test: `sast`, `dast`, `iast`, `fuzzer` or `sca`.'
+ type: string
+ enum: ['sast', 'dast', 'iast', 'fuzzer', 'sca']
+ tool-url:
+ $id: '#/properties/security-testing/items/anyOf/0/properties/tool-url'
+ description: 'Link to the security test.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ tool-version:
+ $id: '#/properties/security-testing/items/anyOf/0/properties/tool-version'
+ description: 'Version of the used tool.'
+ type: string
+ comment:
+ $id: '#/properties/security-testing/items/anyOf/0/properties/comment'
+ description: 'Additional comment to describe the used tool, giving more context. Maximum length 560 chars.'
+ type: string
+ pattern: '^(.|\n){1,560}$'
+ required:
+ - tool-type
+ - tool-name
+ - tool-version
+ - integration
+ type: object
+ type: array
+ security-assessments:
+ $id: '#/properties/security-assessments'
+ additionalItems: false
+ items:
+ $id: '#/properties/security-assessments/items'
+ anyOf:
+ - $id: '#/properties/security-assessments/items/anyOf/0'
+ additionalProperties: false
+ properties:
+ auditor-name:
+ $id: '#/properties/security-assessments/items/anyOf/0/properties/auditor-name'
+ description: 'Name of the third-party security auditor.'
+ type: string
+ auditor-report:
+ $id: '#/properties/security-assessments/items/anyOf/0/properties/auditor-report'
+ description: 'Link to the security report provided by the auditor.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ auditor-url:
+ $id: '#/properties/security-assessments/items/anyOf/0/properties/auditor-url'
+ description: 'Link to the auditor website.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ report-year:
+ $id: '#/properties/security-assessments/items/anyOf/0/properties/report-year'
+ description: 'Year of the report.'
+ type: integer
+ comment:
+ $id: '#/properties/security-assessments/items/anyOf/0/properties/comment'
+ description: 'Additional comment to describe the report giving more context. Maximum length 560 chars.'
+ type: string
+ pattern: '^(.|\n){1,560}$'
+ required:
+ - auditor-name
+ - auditor-url
+ - report-year
+ type: object
+ type: array
+ uniqueItems: true
+ security-contacts:
+ $id: '#/properties/security-contacts'
+ additionalItems: false
+ items:
+ $id: '#/properties/security-contacts/items'
+ anyOf:
+ - $id: '#/properties/security-contacts/items/anyOf/0'
+ additionalProperties: false
+ properties:
+ primary:
+ $id: '#/properties/security-contacts/items/anyOf/0/properties/primary'
+ description: 'Define if the provided contact is the primary one or not.'
+ type: boolean
+ type:
+ $id: '#/properties/security-contacts/items/anyOf/0/properties/type'
+ description: 'Type of contact: `email`, `phone`, or `url`.'
+ type: string
+ enum: ['email', 'phone', 'url']
+ value:
+ $id: '#/properties/security-contacts/items/anyOf/0/properties/value'
+ description: 'Security contact.'
+ type: string
+ pattern: '^[\w+_.-]+@[\w.-]+$|https?:\/\/|[+]*[(]{0,1}[0-9]{1,4}[)]{0,1}[-\s\./0-9]*$'
+ required:
+ - type
+ - value
+ type: object
+ type: array
+ uniqueItems: true
+ vulnerability-reporting:
+ $id: '#/properties/vulnerability-reporting'
+ additionalProperties: false
+ properties:
+ accepts-vulnerability-reports:
+ $id: '#/properties/vulnerability-reporting/properties/accepts-vulnerability-reports'
+ description: 'Define if the maintainers or security team accept security reports or not.'
+ type: boolean
+ bug-bounty-available:
+ $id: '#/properties/vulnerability-reporting/properties/bug-bounty-available'
+ description: 'Define if a bug bounty program is in-place or not.'
+ type: boolean
+ bug-bounty-url:
+ $id: '#/properties/vulnerability-reporting/properties/bug-bounty-url'
+ description: 'Link to the bug bounty program.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ email-contact:
+ $id: '#/properties/vulnerability-reporting/properties/email-contact'
+ description: 'E-mail contact to report vulnerabilities or other related information.'
+ type: string
+ format: idn-email
+ security-policy:
+ $id: '#/properties/vulnerability-reporting/properties/security-policy'
+ description: 'Link to the security policy.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ pgp-key:
+ $id: '#/properties/vulnerability-reporting/properties/pgp-key'
+ description: 'PGP Public Key.'
+ type: string
+ pattern: '^(-----BEGIN PGP PUBLIC KEY BLOCK-----).*([a-zA-Z0-9//\n\/\.\:\+\ \=]+).*(-----END PGP PUBLIC KEY BLOCK-----)$'
+ in-scope:
+ $id: '#/properties/vulnerability-reporting/properties/in-scope'
+ description: 'In-scope vulnerability categories, according to OWASP Top 10 2021. It is recommended to specify a better in-scope list in the security policy.'
+ additionalItems: false
+ items:
+ $id: '#/properties/vulnerability-reporting/properties/in-scope/items'
+ anyOf:
+ - $id: '#/properties/vulnerability-reporting/properties/in-scope/items/anyOf/0'
+ type: string
+ enum: ['broken access control',
+ 'cryptographic failures',
+ 'injection',
+ 'insecure design',
+ 'security misconfiguration',
+ 'vulnerable and outdated components',
+ 'identification and authentication failures',
+ 'software and data integrity failures',
+ 'security logging and monitoring failures',
+ 'ssrf',
+ 'other']
+ type: array
+ uniqueItems: true
+ out-scope:
+ $id: '#/properties/vulnerability-reporting/properties/out-scope'
+ description: 'Out-of-scope vulnerability categories, according to OWASP Top 10 2021. It is recommended to specify a better out-of-scope list in the security policy.'
+ additionalItems: false
+ items:
+ $id: '#/properties/vulnerability-reporting/properties/out-scope/items'
+ anyOf:
+ - $id: '#/properties/vulnerability-reporting/properties/out-scope/items/anyOf/0'
+ type: string
+ enum: ['broken access control',
+ 'cryptographic failures',
+ 'injection',
+ 'insecure design',
+ 'security misconfiguration',
+ 'vulnerable and outdated components',
+ 'identification and authentication failures',
+ 'software and data integrity failures',
+ 'security logging and monitoring failures',
+ 'ssrf',
+ 'other']
+ type: array
+ uniqueItems: true
+ comment:
+ $id: '#/properties/vulnerability-reporting/properties/comment'
+ description: 'Additional comment to describe the in-scope list, out-scope list, preferred contact method, or other context. Maximum length 560 chars.'
+ type: string
+ pattern: '^(.|\n){1,560}$'
+ if:
+ properties:
+ accepts-vulnerability-reports:
+ const: true
+ then:
+ required:
+ - email-contact
+ - security-policy
+ required:
+ - accepts-vulnerability-reports
+ type: object
+ dependencies:
+ $id: '#/properties/dependencies'
+ additionalProperties: false
+ properties:
+ third-party-packages:
+ $id: '#/properties/dependencies/properties/third-party-packages'
+ description: 'Define if the project uses third-party packages.'
+ type: boolean
+ dependencies-lists:
+ $id: '#/properties/dependencies/properties/dependencies-lists'
+ additionalItems: false
+ items:
+ $id: '#/properties/dependencies/properties/dependencies-lists/items'
+ anyOf:
+ - $id: '#/properties/dependencies/properties/dependencies-lists/items/anyOf/0'
+ description: 'Link to the dependencies file (`package.json`, `requirements.txt`, etc).'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ sbom:
+ $id: '#/properties/dependencies/properties/sbom'
+ additionalItems: false
+ items:
+ anyOf:
+ - $id: '#/properties/dependencies/properties/sbom/items'
+ additionalProperties: false
+ properties:
+ sbom-file:
+ $id: '#/properties/dependencies/items/anyOf/0/properties/sbom-file'
+ description: 'Link to the SBOM file.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ sbom-format:
+ $id: '#/properties/dependencies/items/anyOf/0/properties/sbom-format'
+ description: 'Name of the SBOM standard used.'
+ type: string
+ sbom-url:
+ $id: '#/properties/dependencies/items/anyOf/0/properties/sbom-url'
+ description: 'Link to the SBOM standard website or documentation.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ sbom-creation:
+ $id: '#/properties/dependencies/items/anyOf/0/properties/sbom-creation'
+ description: 'Description of how the SBOM is created. Maximum length 560 characters.'
+ type: string
+ pattern: '^(.|\n){1,560}$'
+ type: array
+ uniqueItems: true
+ dependencies-lifecycle:
+ $id: '#/properties/dependencies/properties/dependencies-lifecycle'
+ additionalProperties: false
+ properties:
+ policy-url:
+ $id: '#/properties/dependencies/properties/dependencies-lifecycle/properties/policy-url'
+ description: 'Link to the dependencies lifecycle policy.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ comment:
+ $id: '#/properties/dependencies/properties/dependencies-lifecycle/properties/comment'
+ description: 'Summary about the dependencies lifecycle policy, third-party packages updating process, and deprecation process. Maximum length 560 chars.'
+ type: string
+ pattern: '^(.|\n){1,560}$'
+ type: object
+ env-dependencies-policy:
+ $id: '#/properties/dependencies/properties/env-dependencies-policy'
+ additionalProperties: false
+ properties:
+ policy-url:
+ $id: '#/properties/dependencies/properties/env-dependencies-policy/properties/policy-url'
+ description: 'Link to the enviroment dependencies policy.'
+ type: string
+ format: iri
+ pattern: '^https?:\/\/'
+ comment:
+ $id: '#/properties/dependencies/properties/env-dependencies-policy/properties/comment'
+ description: 'Summary about how third-party dependencies are adopted and consumed in the different environments (dev, test, prod). Maximum length 560 chars.'
+ type: string
+ pattern: '^(.|\n){1,560}$'
+ type: object
+ type: object
+required:
+- header
+- project-lifecycle
+- contribution-policy
+- distribution-points
+- security-contacts
+- vulnerability-reporting
+type: object
+```
\ No newline at end of file
diff --git a/website/content/docs/specification/specification.md b/website/content/docs/specification/specification.md
new file mode 100644
index 0000000..8e1b733
--- /dev/null
+++ b/website/content/docs/specification/specification.md
@@ -0,0 +1,19 @@
+---
+title: "SECURITY INSIGHTS Specification v1.1.0"
+description: "Specification for SECURITY INSIGHTS 1.1.0."
+summary: ""
+draft: false
+menu:
+ docs:
+ parent: "specification"
+weight: 21000
+toc: true
+seo:
+ title: "" # custom title (optional)
+ description: "" # custom description (recommended)
+ canonical: "" # custom canonical URL (optional)
+ noindex: false # false (default) or true
+
+---
+
+{{< include-markdown "/specification.md" >}}
diff --git a/website/content/licenses.md b/website/content/licenses.md
new file mode 100644
index 0000000..d4af913
--- /dev/null
+++ b/website/content/licenses.md
@@ -0,0 +1,26 @@
+---
+title: "Licenses"
+description: "Licenses for SECURITY INSIGHTS Specification."
+summary: ""
+draft: false
+type: "doc"
+seo:
+ title: "" # custom title (optional)
+ description: "" # custom description (recommended)
+ canonical: "" # custom canonical URL (optional)
+ noindex: false # false (default) or true
+---
+
+SECURITY INSIGHTS Specificaiton is an OpenSSF (Open Source Security Foundation) project.
+
+## Specification License
+
+SECURITY INSIGHTS Specification is subject to the **Community Specification License 1.0** available at [https://github.com/CommunitySpecification/1.0](https://github.com/CommunitySpecification/1.0).
+
+## Source Code License
+
+If source code is included in this repository, or for sample or reference code included in the specification itself, that code is subject to the MIT license unless otherwise designated. In the case of any conflict or confusion within this specification repository between the Community Specification License and the MIT or other designated license, the terms of the Community Specification License shall apply.
+
+If source code is included in this repository, or for sample or reference code included in the specification itself, that code is subject to the MIT license unless otherwise marked.
+
+In the case of any conflict or confusion within this specification repository between the Community Specification License and the designated source code license, the terms of the Community Specification License shall apply.
\ No newline at end of file
diff --git a/website/hugo_stats.json b/website/hugo_stats.json
new file mode 100644
index 0000000..ddc66fc
--- /dev/null
+++ b/website/hugo_stats.json
@@ -0,0 +1,320 @@
+{
+ "htmlElements": {
+ "tags": [
+ "a",
+ "article",
+ "aside",
+ "blockquote",
+ "body",
+ "button",
+ "circle",
+ "code",
+ "details",
+ "div",
+ "em",
+ "figcaption",
+ "figure",
+ "footer",
+ "form",
+ "g",
+ "h1",
+ "h2",
+ "h3",
+ "h5",
+ "head",
+ "header",
+ "html",
+ "img",
+ "input",
+ "kbd",
+ "label",
+ "li",
+ "line",
+ "link",
+ "main",
+ "meta",
+ "nav",
+ "noscript",
+ "ol",
+ "p",
+ "path",
+ "pre",
+ "script",
+ "section",
+ "small",
+ "span",
+ "strong",
+ "style",
+ "summary",
+ "svg",
+ "table",
+ "tbody",
+ "td",
+ "template",
+ "th",
+ "thead",
+ "time",
+ "title",
+ "tr",
+ "ul"
+ ],
+ "classes": [
+ "DocSearch-Label",
+ "active",
+ "align-items-center",
+ "anchor",
+ "bg-dots",
+ "blog",
+ "blog-header",
+ "btn",
+ "btn-close",
+ "btn-cta",
+ "btn-lg",
+ "btn-link",
+ "btn-primary",
+ "btn-toggle",
+ "btn-toggle-nav",
+ "card",
+ "card-body",
+ "card-list",
+ "categories",
+ "chroma",
+ "col-lg-10",
+ "col-lg-11",
+ "col-lg-12",
+ "col-lg-5",
+ "col-lg-8",
+ "col-lg-9",
+ "col-md-12",
+ "col-xl-3",
+ "col-xl-4",
+ "col-xl-8",
+ "col-xl-9",
+ "collapse",
+ "collapsed",
+ "collapsible-sidebar",
+ "container",
+ "container-fluid",
+ "container-lg",
+ "content",
+ "contributors",
+ "created-date",
+ "d-flex",
+ "d-lg-block",
+ "d-lg-none",
+ "d-md-block",
+ "d-md-none",
+ "d-none",
+ "d-xl-block",
+ "d-xl-none",
+ "docs",
+ "docs-content",
+ "docs-link",
+ "docs-links",
+ "docs-sidebar",
+ "docs-toc",
+ "doks-sidebar",
+ "error404",
+ "expressive-code",
+ "flex-column",
+ "flex-grow-1",
+ "flex-lg-row",
+ "flex-md-row",
+ "flex-row",
+ "flex-sm-row",
+ "flex-xl-nowrap",
+ "footer",
+ "form-control",
+ "form-control-lg",
+ "frame",
+ "fs-5",
+ "fw-normal",
+ "h-auto",
+ "h3",
+ "h4",
+ "h5",
+ "header",
+ "highlight",
+ "home",
+ "icon",
+ "icon-tabler",
+ "icon-tabler-arrow-left",
+ "icon-tabler-arrow-right",
+ "icon-tabler-brand-github",
+ "icon-tabler-clock",
+ "icon-tabler-dots-vertical",
+ "icon-tabler-menu",
+ "icon-tabler-moon",
+ "icon-tabler-search",
+ "icon-tabler-sun",
+ "icon-tabler-x",
+ "justify-content-between",
+ "justify-content-center",
+ "justify-content-end",
+ "justify-content-start",
+ "lead",
+ "licenses",
+ "list",
+ "list-inline",
+ "list-inline-item",
+ "list-unstyled",
+ "list-view",
+ "m-2",
+ "mb-0",
+ "mb-1",
+ "me-2",
+ "me-auto",
+ "me-lg-1",
+ "me-lg-3",
+ "message",
+ "modal",
+ "modal-body",
+ "modal-content",
+ "modal-dialog",
+ "modal-dialog-scrollable",
+ "modal-footer",
+ "modal-fullscreen-md-down",
+ "modal-header",
+ "modal-title",
+ "ms-2",
+ "ms-3",
+ "ms-lg-2",
+ "mt-3",
+ "mt-n3",
+ "mx-2",
+ "mx-auto",
+ "mx-xl-auto",
+ "my-3",
+ "nav",
+ "nav-item",
+ "nav-link",
+ "navbar",
+ "navbar-brand",
+ "navbar-expand-lg",
+ "navbar-nav",
+ "not-content",
+ "offcanvas",
+ "offcanvas-body",
+ "offcanvas-end",
+ "offcanvas-header",
+ "offcanvas-start",
+ "offcanvas-title",
+ "order-3",
+ "order-lg-4",
+ "p-0",
+ "p-2",
+ "page-footer-meta",
+ "page-links",
+ "page-nav",
+ "pb-1",
+ "pb-3",
+ "position-relative",
+ "px-0",
+ "query-no-results",
+ "reading-time",
+ "rounded",
+ "rounded-pill",
+ "row",
+ "search-form",
+ "search-input",
+ "search-loading",
+ "search-no-recent",
+ "search-no-results",
+ "search-result",
+ "search-results",
+ "search-text",
+ "section",
+ "section-features",
+ "section-md",
+ "show",
+ "single",
+ "small",
+ "social-link",
+ "status",
+ "sticky-top",
+ "stretched-link",
+ "submitted",
+ "tags",
+ "taxonomy",
+ "text-body",
+ "text-body-secondary",
+ "text-center",
+ "text-decoration-none",
+ "text-end",
+ "text-lg-end",
+ "text-lg-start",
+ "text-muted",
+ "text-reset",
+ "title",
+ "title-submitted",
+ "toc-mobile",
+ "visually-hidden",
+ "w-100",
+ "wrap"
+ ],
+ "ids": [
+ "1-how-to-contribute",
+ "1-introduction",
+ "2-issue-reporting",
+ "2-versioning-scheme",
+ "3-review-process",
+ "3-version-release-process",
+ "31-major-releases",
+ "32-minor-releases",
+ "33-patch-releases",
+ "34-procedure-for-major-releases",
+ "4-changelog",
+ "4-code-of-conduct",
+ "5-communication",
+ "5-licensing",
+ "6-review-and-adoption",
+ "6-thanks",
+ "TableOfContents",
+ "buttonColorMode",
+ "contribution-policy",
+ "dependencies",
+ "distribution-points",
+ "documentation",
+ "doks-docs-nav",
+ "false-information-in-the-security-insightsyml",
+ "fuller-sample",
+ "further-reading",
+ "header",
+ "introduction",
+ "malicious-pull-request",
+ "minimum-sample",
+ "missing-pull-request-review-or-lacks-in-the-review-process",
+ "offcanvasNavMain",
+ "offcanvasNavMainLabel",
+ "offcanvasNavSection",
+ "offcanvasNavSectionLabel",
+ "private-information-sharing",
+ "project-lifecycle",
+ "query",
+ "search-form",
+ "searchModal",
+ "searchModalLabel",
+ "searchResults",
+ "searchToggleDesktop",
+ "searchToggleMobile",
+ "section-0b79795d3efc95b9976c7c5b933afce2",
+ "section-7d61983c34edc2a8cabbea71c4732f62",
+ "section-875b0e30e76428bc0706b781b36b31aa",
+ "security-artifacts",
+ "security-assessments",
+ "security-contacts",
+ "security-insights-github-action",
+ "security-insights-validator-docker-image",
+ "security-insightsyml",
+ "security-testing",
+ "socialMenu",
+ "source-code-license",
+ "specification-license",
+ "supply-chain",
+ "toc",
+ "user-stories",
+ "vulnerability-reporting",
+ "why-must-this-specification-exist"
+ ]
+ }
+}
diff --git a/website/layouts/index.html b/website/layouts/index.html
new file mode 100644
index 0000000..746c9e6
--- /dev/null
+++ b/website/layouts/index.html
@@ -0,0 +1,51 @@
+{{ define "main" }}
+
+
+
+
+ {{ .Title }}
+
+
+ {{ .Params.lead | safeHTML }}
+ 🪄 Get Started 🔮 + {{ .Content }} +
+
+
+ {{ end -}}
+ {{ if eq $.Site.Language.LanguageName "English" }}
+
+
+
+
+
+
+ Read the specification
+Learn more about the SECURITY INSIGHTS and adopt it for your project.
+
+
+ Join our Working Group
+Contribute to the SECURITY-INSIGHTS specification by joining our OpenSSF Working Group Metrics & Metadata.
+
+
+
+
+