This Working Group develops the FPSOT security specification.
The specification covers how FPSOT projects build, release and maintain their software and their specifications securely: a profile of the NIST Secure Software Development Framework, threat models, security requirements and their OWASP ASVS level, the review and the automated analysis of changes, secrets, the software supply chain (pinned dependencies and actions, software bills of materials, build provenance, signed releases and reproducible builds), the reporting, scoring, identification and disclosure of vulnerabilities, including a private pre-notice to public-sector adopters, supported versions and their end of life, the SECURITY.md file of each repository, flaws in specifications and security tests. It includes a template SECURITY.md file in English and French.
It does not cover the security controls of an operating organization, identity and sign-in, the choice of tools for each language, or legal advice. Vulnerability reports are never Working Group activity: they go through the private channels the specification sets.
Any changes of Scope are not retroactive.