Or else?

I’ll add clarification. Escalation means contacting the OpenJS Foundation CNA if the project team is unresponsive. The CNA ensures the report is acknowledged, helps coordinate disclosure, and can assign a CVE if necessary. It’s not a bypass or a guarantee of a faster fix. It is just a safeguard to ensure reports are handled properly.

This change is also being adopted by other projects in the foundation (e.g. nodejs/node#59806, jquery/jquery#5701....), so we’ll have a consistent approach across OpenJS as discussed on the CPC Meeting.

@UlisesGascon You answered in the meantime, but below was what i wanted to answer you before your post.

First of all, an escalation should be imho not the first thing I should read. It should be at the bottom of the document, after we described how we handle security reports.

We have self mandated 4 day reaction time.

Also i think it is critical to not clarify what the scope of the escalation is. What is here the role of the OpenJS Foundation?
What is ultima ratio of the escalation? Keeping potential project funds? Project Takeover by the Foundation? Creating a PR which fastify-maintainers are obligated to merge?

Or is the wording "Escalation" the issue? Is it more about that the OpenJS Foundation CNA will then separately will publish a CVE? Then the wording as "escalation" is inappropriate.

Without any clarification I think we should reject this policy change.

I see, that also in the nodejs pr the "escalation" was needing clarification. I think we should encourage that the OpenJS Foundation changes the template for the sake of clarity.

Thanks for the feedback @Uzlopak! I will bring this discussion to the Security Collab Space to re-define the policy/template. In the meantime I relocated the text in ac96ec2 with your suggestions included.

@fastify/leads

Do you agree with this PR?