Could this be done by the same entity / group of people as the people processing the reports?

If not, how would one contact the working group for these not-covered-by-this-rep vulnerabilities?

Could this be done by the same entity / group of people as the people processing the reports?

By "done", do you mean helping to contact the relevant companies, or doing the engineering work?

If not, how would one contact the working group for these not-covered-by-this-rep vulnerabilities?

I believe the intention here is to say "if you find a vulnerability in a robot/software not directly related to this REP, we may know the people who are responsible and can direct you there". I would think the reporting process would be the same as outlined below, its just that the ROS 2 security group wouldn't take any direct action other than redirecting.

But I didn't write this. @SidFaber, any feedback here?

All reporting to happen through the security@ email address; the security WG's best communication vehicle is our matrix chat room. The person/people triaging incoming email to that address should also be included in the Security WG matrix chat room, and simply call to the chat room for any support needed.

So if the triage person is not able to quickly handle the report, they should call out for help in matrix.

All reporting to happen through the security@ email address

This part of the REP is discussing reporting things that are not in scope. In that sense, do we really want them still reporting to security@? I'd say the reporter should contact the WG on their own (in matrix or via our google group) for help on issues outside the scope of the VDP, or security@ could get swamped with out of scope issues.

Right now this doc only gives the reader a single entry point which is the security@ email. If we want reports elsewhere, we need to add another entry point. The google group is private, and I think we want to keep the matrix room private?

Agreed the security@ email could get spammed, but it should only be with security related issues. I would imagine OR would manage this similar to abuse@ and postmater@ email aliases.

If we want reports elsewhere, we need to add another entry point. The google group is private, and I think we want to keep the matrix room private?

Neither are private, nor should they be. That's one of the reasons we don't want the WG to be driving vuln handling-- we can't handle embargo in a public group, and we want the security WG to be completely open to the public.

We could add a link to https://github.com/ros-security/community, which contains the security WG communications channels (I notice now that we're missing the google group email though, I'll add that).

The Security WG has always seemed very open to discussing security issues, but looking at it now I don't see a public facing, easily accessible "contact us" landing place. I've added an agenda item to discuss public interaction at the next WG meeting and would propose leaving this as-is for the time being. Once the WG settles on an approach for public interaction, we can open a PR on how to interact with the Security WG.

We've changed this even more down below. @SidFaber @kyrofa is there more to be done for this particular item, or can we resolve this conversation?