<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>Core reviewers,</div>
<div><br>
</div>
<div>Please review this document:</div>
<div><a href="https://github.com/openstack/governance/blob/master/reference/tags/vulnerability_managed.rst">https://github.com/openstack/governance/blob/master/reference/tags/vulnerability_managed.rst</a></div>
<div><br>
</div>
<div>It describes how vulnerability management is handled at a high level for Kolla. When we are ready, I want the kolla delivery repos vulnerabilities to be managed by the VMT team. By doing this, we standardize with other OpenStack processes for handling
security vulnerabilities.</div>
<div><br>
</div>
<div>The first step is to form a kolla-coresec team, and create a separate kolla-coresec tracker. I have already created the tracker for kolla-coresec and the kolla-coresec team in launchpad:</div>
<div><br>
</div>
<div><a href="https://launchpad.net/~kolla-coresec">https://launchpad.net/~kolla-coresec</a></div>
<div><br>
</div>
<div><a href="https://launchpad.net/kolla-coresec">https://launchpad.net/kolla-coresec</a></div>
<div><br>
</div>
<div>I have a history of security expertise, and the PTL needs to be on the team as an escalation point as described in the VMT tagging document above. I also need 2-3 more volunteers to join the team. You can read the requirements of the job duties in the
vulnerability:managed tag.</div>
<div><br>
</div>
<div>If your interested in joining the VMT team, please respond on this thread. If there are more then 4 individuals interested in joining this team, I will form the team from the most active members based upon liberty + mitaka commits, reviews, and PDE spent.</div>
<div><br>
</div>
<div>Regards</div>
<div>-steve</div>
<div><br>
</div>
</body>
</html>