# OpenJS Security Working Group - June 22, 2026 > [!question] Lingering Questions > - Who is authorized to grant project credentials for the bucket model, and how is that authority audited to prevent capture? > - What is the incident response if the Cloudflare worker or its JSON credential store is compromised? > - Will the extra CNA rules (CWE, credits) be mandatory or advisory, and who decides? > [!tip] Article Ideas > - Compare the OpenJS bucket/credential model to how WordPress.org's plugin team currently handles CVE disclosure — a concrete cross-ecosystem case study. #articleseed > [!link] Cross Reference > - [[3. Resources/Permanent Notes/Competence Is the Prerequisite for Distributing Authority]] — adjacent delegation principle; this source's claim is about splitting routine-vs-hard work, not competence transfer > - [[3. Resources/Permanent Notes/Delegated Credentials Must Attenuate Rather Than Escalate]] — adjacent credential-scoping principle from a different domain (agentic AI) > - [[3. Resources/MOCs/Open Source Governance MOC]] > [!quote] Vocabulary > - **CNA (CVE Numbering Authority)** — an organization authorized by MITRE to assign CVE IDs. > - **Bucket model** — scoped CVE reservations per project, with separate test and production environments, preventing projects from seeing each other's pending disclosures. ## Metadata - Source: [[3. Resources/Readwise/Articles/OpenJS Security Working Group - June 22, 2026]] - Category: Podcast/meeting recording (YouTube) ## Author's thesis The OpenJS Security Working Group is prototyping a self-service CNA API that shrinks a member project's CVE-issuance work to roughly four CLI commands, adding a scoped "bucket" model MITRE's own tooling lacks, while keeping the CNA team responsible for the parts that actually require judgment: credentials, MITRE coordination, disputes, and rejections. ## Key arguments (≤3) 1. **Delegating issuance without delegating judgment scales a bottlenecked process** — projects gain autonomy over routine CVE work while the CNA team keeps the "interesting" coordination and dispute work. 2. **MITRE's shared visibility is a real gap** — today, reservations are exposed across the org; the bucket model scopes visibility per project and separates test from production. 3. **Minimal, serverless infrastructure (GitHub Actions + a Cloudflare worker, Git as audit log) can carry security-critical tooling** — trading warm-up latency for a smaller attack surface and lower cost. ## Claim atoms ### CNA API delegates CVE issuance to projects without gatekeeping > [!quote] ID:rw_openjs_h1 > "the project will manage or operate their own CVEs, like they can request, reserve, query, publish, update when they make sense" Where: mid-meeting, core thesis of the issue-337 demo. Why: reframes the CNA team from issuer to coordinator — a reusable OSPO delegation pattern, the source's strongest reusable claim. ### Bucket model scopes reservations MITRE currently exposes org-wide > [!quote] ID:rw_openjs_h2 > "if we want to give credentials to anyone any project within the foundation to issue their own CVs, that's going to be challenging because everybody will see other's reservation" Where: architecture section. Why: names a concrete, previously-unaddressed disclosure risk (cross-project reservation visibility) and the specific fix. ### No standing server — GitHub Actions plus a Cloudflare worker > [!quote] ID:rw_openjs_h3 > "instead of having like a full server running all the time and things like that, the idea was to minimize the impact" Where: infra-design rationale. Why: a reusable low-infra security-tooling pattern — Git as audit log, no always-on attack surface. ## Permanent candidates - **Delegated authority works when coordination, not issuance, stays central** (H1) — no existing Permanent note captures this specific split; promoted below. - **Scoped visibility prevents cross-project disclosure leakage** (H2) — related to but distinct from existing attenuation/competence notes; promoted below. - H3 (serverless security tooling) is a useful implementation detail but doesn't clear the reusable-claim bar on its own — left as a Literature atom only. ## Processing checklist - [x] Checked existing Permanent notes for delegation/credential claims before creating new ones - [ ] Watch for the public "Open CNA tools" repo and POC README (issue 337) - [x] Connect into the relevant MOC — [[3. Resources/MOCs/Open Source Governance MOC]] ## Links - [[3. Resources/MOCs/Open Source Governance MOC]] — CVE delegation and CNA authority are core governance-infrastructure topics - [[3. Resources/Permanent Notes/Competence Is the Prerequisite for Distributing Authority]] — because contrasts on what makes delegation safe; that note is about competence transfer, this source is about task-type separation - [[3. Resources/Permanent Notes/Delegated Credentials Must Attenuate Rather Than Escalate]] — because applies-in; the bucket model's scoped, non-escalating credentials are a concrete instance of that principle