From 81a5b5f8fed8a0b39f3af230b5824479c74de4f3 Mon Sep 17 00:00:00 2001 From: tym83 <6355522@gmail.com> Date: Tue, 7 Apr 2026 00:07:00 +0500 Subject: [PATCH 1/3] feat: add security finding issue template Standard issue template for maintainers to track security scanner findings with proper severity, triage status, and affected components. Assisted-by: LLM Signed-off-by: tym83 <6355522@gmail.com> --- ISSUE_TEMPLATE/security-finding.yml | 81 +++++++++++++++++++++++++++++ 1 file changed, 81 insertions(+) create mode 100644 ISSUE_TEMPLATE/security-finding.yml diff --git a/ISSUE_TEMPLATE/security-finding.yml b/ISSUE_TEMPLATE/security-finding.yml new file mode 100644 index 0000000..f1d60e7 --- /dev/null +++ b/ISSUE_TEMPLATE/security-finding.yml @@ -0,0 +1,81 @@ +name: Security Finding +description: Report an automated security scanner finding (for maintainers) +title: "[security] " +labels: ["security/triage-needed"] +body: + - type: markdown + attributes: + value: | + **This template is for automated scanner findings reviewed by maintainers.** + If you are an external reporter, please use [Private Vulnerability Reporting](https://github.com/cozystack/cozystack/security/advisories/new) instead. + - type: input + id: cve + attributes: + label: CVE ID + placeholder: CVE-YYYY-NNNNN + validations: + required: true + - type: dropdown + id: severity + attributes: + label: Severity + options: + - Critical + - High + - Medium + - Low + validations: + required: true + - type: input + id: package + attributes: + label: Affected package + placeholder: "e.g., libcrypto3, stdlib, redis" + validations: + required: true + - type: input + id: installed_version + attributes: + label: Installed version + placeholder: "e.g., 3.5.1-r0" + - type: input + id: fixed_version + attributes: + label: Fixed version + placeholder: "e.g., 3.5.5-r0 (or 'none available')" + - type: textarea + id: affected_components + attributes: + label: Affected Cozystack components + placeholder: | + - packages/system/velero + - packages/apps/postgres + validations: + required: true + - type: textarea + id: description + attributes: + label: Description + placeholder: Brief description of the vulnerability and its impact + validations: + required: true + - type: textarea + id: references + attributes: + label: References + placeholder: | + - https://nvd.nist.gov/vuln/detail/CVE-YYYY-NNNNN + - https://github.com/advisories/GHSA-XXXX + - type: dropdown + id: triage_status + attributes: + label: Triage status + options: + - new (needs triage) + - confirmed + - false-positive + - accepted-risk + - in-progress + - fixed + validations: + required: true From 5fe2b46ffcf3ce5fa0ebffbb7062021f3ad6b747 Mon Sep 17 00:00:00 2001 From: tym83 <6355522@gmail.com> Date: Tue, 7 Apr 2026 18:16:29 +0500 Subject: [PATCH 2/3] docs: add CNCF security email to issue template Add cncf-cozystack-security@lists.cncf.io as alternative reporting channel for external reporters. Assisted-by: LLM Signed-off-by: tym83 <6355522@gmail.com> --- ISSUE_TEMPLATE/security-finding.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ISSUE_TEMPLATE/security-finding.yml b/ISSUE_TEMPLATE/security-finding.yml index f1d60e7..f779f9a 100644 --- a/ISSUE_TEMPLATE/security-finding.yml +++ b/ISSUE_TEMPLATE/security-finding.yml @@ -7,7 +7,7 @@ body: attributes: value: | **This template is for automated scanner findings reviewed by maintainers.** - If you are an external reporter, please use [Private Vulnerability Reporting](https://github.com/cozystack/cozystack/security/advisories/new) instead. + If you are an external reporter, please use [Private Vulnerability Reporting](https://github.com/cozystack/cozystack/security/advisories/new) or email cncf-cozystack-security@lists.cncf.io instead. - type: input id: cve attributes: From ee7e5cd3c61ceb0282986c1d62ba238cc117f58f Mon Sep 17 00:00:00 2001 From: Timur Tukaev Date: Fri, 2 Oct 2026 06:43:26 +0500 Subject: [PATCH 3/3] feat(security): record scanner and finding ID in security finding issues The same finding is reported again on every scanner run, and without the scanner name and its own identifier there is no reliable way to tell a repeat from a new issue or to trace an issue back to the alert that raised it. The form now asks for both; the finding ID stays optional because not every scanner assigns one. The CVE field becomes a vulnerability ID that also accepts GHSA and other advisory IDs, since a required CVE field cannot be filled for findings that have no CVE assigned. The default title spells out the package and ID, so issues for the same finding are easy to search for. Assisted-by: LLM Signed-off-by: Timur Tukaev --- ISSUE_TEMPLATE/security-finding.yml | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/ISSUE_TEMPLATE/security-finding.yml b/ISSUE_TEMPLATE/security-finding.yml index f779f9a..864bb67 100644 --- a/ISSUE_TEMPLATE/security-finding.yml +++ b/ISSUE_TEMPLATE/security-finding.yml @@ -1,6 +1,6 @@ name: Security Finding description: Report an automated security scanner finding (for maintainers) -title: "[security] " +title: "[security] : " labels: ["security/triage-needed"] body: - type: markdown @@ -9,12 +9,26 @@ body: **This template is for automated scanner findings reviewed by maintainers.** If you are an external reporter, please use [Private Vulnerability Reporting](https://github.com/cozystack/cozystack/security/advisories/new) or email cncf-cozystack-security@lists.cncf.io instead. - type: input - id: cve + id: vulnerability_id attributes: - label: CVE ID - placeholder: CVE-YYYY-NNNNN + label: Vulnerability ID + description: CVE where one is assigned, otherwise the GHSA or other advisory ID. + placeholder: "e.g., CVE-YYYY-NNNNN or GHSA-xxxx-xxxx-xxxx" validations: required: true + - type: input + id: scanner + attributes: + label: Scanner + placeholder: "e.g., Trivy, Grype, osv-scanner, Dependabot" + validations: + required: true + - type: input + id: finding_id + attributes: + label: Scanner finding ID + description: Rule ID, alert URL or other identifier the scanner gives this finding, if any. Used to match repeat reports of the same finding across scan runs. + placeholder: "e.g., https://github.com/cozystack/cozystack/security/code-scanning/123" - type: dropdown id: severity attributes: