I have recently been looking at our external dependencies and noticed that a number of external dependencies, e.g. https://github.com/grpc-ecosystem/grpc-httpjson-transcoding, https://github.com/google/jwt_verify_lib/, https://github.com/circonus-labs/libcircllhist, do not provide versioned releases.

I think this is a concern from a security perspective, since it is challenging to systematically monitor for new releases when security issues creep into our external dependencies. You essentially have to watch every commit. There are other problems, for example being unclear when it's safe to take a master snapshot and call it stable.

I would like to propose that we revise our security policy to disallow any new external repositories that might impact the data plane unless they show some release discipline. Basically, they should have some history of cutting releases and providing release notes. We should also downgrade the security posture of extensions relying on external repositories directly that do not have release discipline.

@envoyproxy/security-team