Proposal: Switch security reporting to GitHub private vulnerability reporting

[Vad1mo]

Proposal to replace the CNCF groups.io security mailing list (cncf-harbor-security@lists.cncf.io) with GitHub private vulnerability reporting and repository security advisories as Harbor's vulnerability intake and handling workflow.

Why

The mailing-list process is manual and fragmented: CVE requests are filed out-of-band with MITRE, fix PRs get developed in the public repo before embargo lifts, and email is a hurdle for reporters and maintainers.

Highlights

• Every advantage in the proposal is backed by a GitHub Code Security doc reference
• Intake, triage, embargoed fix (temporary private fork), CVE assignment (GitHub as CNA), and disclosure become one advisory artifact
• Distributor coordination (cncf-harbor-distributors-announce) and disclosure timing are unchanged
• CNCF does not mandate the list; Argo CD, in-toto, and Backstage already use GitHub's report form
• Trade-offs and open issues are called out (GitHub account requirement, no CI on private forks, OCI/container Dependabot gap, spam triage)

Discussion: Harbor community meeting 8 July 2026

[OrlinVasilev]

@Vad1mo why did you close this one?