A security.txt for gits?
summary
Proposal for a machine-readable repo file called security gtxt that encodes coordinated vulnerability disclosure contacts and an up- & downstream feed so dependent projects get automated alerts before CVE publication. Prototype repository lives on Codeberg with two open issues: one for CVD metadata and one for feed mechanics; work is ongoing with BSI and InÖG. Applied context: IRIS-Connect runs in 54 public‑health centers serving 30.4 million citizens. Concept uses RSS‑style notifications and robots/ security.txt analogies; prototype exists but not yet standardized or widely adopted.
AI-written summary · about
chapters (8)
- 0:00Intro
- 0:28The idea
- 0:47The name
- 0:58Security researchers
- 1:13Life cycle of a vulnerability
- 2:15Challenges
- 6:52The big picture
- 7:03Make kids talk
related talks
43mOpen Source Runs the World, Why Not Vulnerability Identifiers?
39mFrom CVD to Secure Releases: Automating Security from Source to Releases
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
01h 08mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
32mStaring Into the Abyss with the Security Technical Advisory Group
31mSharing Security Secrets: How to Encourage Security Advocates
19mCommunity-led Security at ASF