Should we have a ""Security Manager" for the rubysec organization?

[jasnow]

Should we have a ""Security Manager" for the rubysec organization?

[jasnow]

Two articles about this role:

• https://github.blog/changelog/2021-10-21-introducing-the-organization-level-security-manager-role
• https://docs.github.com/en/organizations/managing-peoples-access-to-your-organization-with-roles/managing-security-managers-in-your-organization

[simi]

Isn't that intended more for "code repos" over "collective repos" like this one?

[jasnow]

Isn't that intended more for "code repos" over "collective repos" like this one?

Good question - The answer might be no, but I thought the team should discuss and decide in public.

[jasnow]

Over under https://github.com/rubysec/bundler-audit, there is an security-related issue and PR:

• Add a Security Policy bundler-audit#309
• Add SECURITY.md vulnerability reporting policy bundler-audit#420

[jasnow]

@rubysec/maintainers @postmodern @reedloden @phillmv - Can we created a org email, such as rubysec-security@gmail.com to receive any security-related correspondence?