Follow the latest coverage, related explainers and connected technology stories.
The CNCF published practical guidance for small and medium-sized projects that do not specialize in security to manage vulnerability reports, from providing a clear private reporting channel to testing the fix and publishing the update and CVE simultaneously. The guidance emphasizes that high-risk projects may need a more advanced approach.