Security Collab Space Meeting - August 25, 2025

Security Collab Space Meeting - August 25, 2025 🔗 **Source:** [Security Collab Space Meeting - August 25, 2025](https://www.youtube.com/watch?v=pLgWwdijTw8) > [!note]+ Document Notes > tags: [security, nodejs, incident-response, vulnerability-management] > author: OpenJS Foundation > source: YouTube > reference: https://www.youtube.com/watch?v=pLgWwdijTw8 > date created: 2024-12-28 12:00 > > # 🏷️ Title: Security Collab Space Meeting - August 25, 2025 >  ## 🧰 Action Inbox - [H1] Review CPC PR for project security policies — Rafael's template needs approval #security - [H2] Create Alpha Omega blog post with Kylie — showcase ESLint and Webpack examples #outreach - [H3] Finalize foundation incident response plan — gather feedback from Jordan and Chris #incident-response ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [OpenJS Foundation](https://openjsf.org) - [Security Collab Space](https://github.com/openjs-foundation/security-collab-space) ## 📝 Summary - What happened: Final August 2025 Security Collab Space meeting covering incident response plans, project security policies, and Alpha Omega support outreach - Why it matters: Multiple JavaScript ecosystem projects are adopting standardized security policies, creating more consistent vulnerability disclosure processes - Key stakeholders: OpenJS Foundation projects, CPC (Cross Project Council), Alpha Omega initiative, individual project maintainers - Risks and tradeoffs: Volunteer project capacity vs. security requirements, standardization vs. project autonomy - Bottom line takeaway: Security standardization momentum building across JavaScript ecosystem with concrete policy templates and incident response frameworks ## 📖 Main Content The meeting focused on progressing standardized security practices across the JavaScript ecosystem. Rafael presented updates on security policy templates that multiple projects (Webpack, Fastify, ESLint) are adopting, with a 14-day escalation timeline to the CNA (CVE Numbering Authority) as a default that projects can customize. The team discussed balancing volunteer project capacity with security requirements, noting that projects generally want to maintain ownership and learn rather than delegate security responsibilities to the foundation. Alpha Omega support outreach continues through direct messaging to projects, with plans for a blog post showcasing successful implementations. A foundation-level incident response plan is under development with active feedback from multiple stakeholders. The group emphasized making security policies customizable templates rather than rigid requirements, recognizing the diverse needs and capacities of different open source projects. ## 🗒️ Notes #### ⏱️ [00:00](https://youtu.be/pLgWwdijTw8?t=0) — [H1] Meeting Opening and Announcements - Key idea: Final Security Collab Space meeting of August 2025 with incident response plan progress - Evidence: "We are working on a lot of instant response plans to the JavaScript ecosystem" #### ⏱️ [02:15](https://youtu.be/pLgWwdijTw8?t=135) — [H2] JavaScript Security Training Promotion - Key idea: Free JavaScript security training launched recently needs continued promotion - Evidence: "We still have that free JavaScript security training. I should pull some data from that" #### ⏱️ [03:30](https://youtu.be/pLgWwdijTw8?t=210) — [H1] Security Policies for Project Onboarding (Issue 290) - Key idea: CPC approval received for security policy template with Toby's feedback on document merging - Evidence: "We got an approval from Blisses and also a comment from Toby about merging documents" #### ⏱️ [06:45](https://youtu.be/pLgWwdijTw8?t=405) — [H2] 14-Day Escalation Timeline Discussion - Key idea: Template includes 14-day escalation path to CNA but should be customizable per project - Evidence: "I'm not a big fan of putting day timelines in for volunteer-led projects" #### ⏱️ [09:20](https://youtu.be/pLgWwdijTw8?t=560) — [H3] CPC Meeting Advocacy Plans - Key idea: Security policies will be advocated at Wednesday CPC meeting for broader adoption - Evidence: "We can advocate a bit for this topic on the CPC meeting on Wednesday" #### ⏱️ [11:00](https://youtu.be/pLgWwdijTw8?t=660) — [H2] Alpha Omega Support Media (Issue 291) - Key idea: Direct messaging approach working well, need blog post from Kylie to showcase project support - Evidence: "DM approach has been working good recently with the project" #### ⏱️ [13:15](https://youtu.be/pLgWwdijTw8?t=795) — [H3] Blog Post Planning with Project Showcases - Key idea: Blog post should feature successful implementations like Webpack and ESLint as examples - Evidence: "We could mention the project that started doing the work like Webpack yes link as a showcase" #### ⏱️ [15:30](https://youtu.be/pLgWwdijTw8?t=930) — [H2] Minimum Security Reporting Guidelines (Issue 285) - Key idea: Aligning projects with minimum guidelines depends on landing Rafael's CPC PR first - Evidence: "It's going to be probably good driven now that we will expect to land the PR" #### ⏱️ [17:45](https://youtu.be/pLgWwdijTw8?t=1065) — [H1] Security Activities Delegation Discussion (Issue 286) - Key idea: Projects prefer learning and ownership over delegating security responsibilities to foundation - Evidence: "They want to take ownership and we want to learn and we want to grow in this area" #### ⏱️ [19:30](https://youtu.be/pLgWwdijTw8?t=1170) — [H2] Foundation Incident Response Plan Progress (PR 289) - Key idea: Substantial feedback received from Steve and Ben, seeking input from Jordan and Chris - Evidence: "I got a lot of feedback from Steve and from Ben already on this PR" #### ⏱️ [21:00](https://youtu.be/pLgWwdijTw8?t=1260) — [H3] Working Session Tomorrow Planning - Key idea: Tuesday working session will gather more stakeholder input before broader CPC discussion - Evidence: "Tomorrow is a working session. So I think we should just get more folks to weigh in" ## 📚 References - [OpenJS Security Collab Space Issues](https://github.com/openjs-foundation/security-collab-space/issues) - [Cross Project Council](https://github.com/openjs-foundation/cross-project-council) - [Alpha Omega Project](https://alpha-omega.dev/) ## 🗣️ Paraphrase - Multiple JavaScript ecosystem projects are adopting standardized security incident response templates with customizable escalation timelines to balance volunteer capacity with security needs - The Alpha Omega initiative is successfully supporting projects through direct outreach, with plans for broader promotion through blog posts showcasing successful implementations like Webpack and ESLint - Projects generally prefer maintaining security ownership and building internal capabilities rather than delegating security responsibilities to the foundation level ## 📰 Newsletter The JavaScript ecosystem is making significant strides in security standardization! The OpenJS Foundation's Security Collab Space is seeing real momentum with projects like Webpack, Fastify, and ESLint adopting standardized incident response templates. What's particularly encouraging is that projects want to own their security processes rather than delegate them - they're asking for guidance and templates to build their own capabilities. The 14-day escalation timeline to CVE numbering authorities provides a reasonable default while remaining customizable for each project's volunteer capacity. The Alpha Omega initiative continues supporting projects through direct outreach, and we're seeing concrete results. A foundation-level incident response plan is also in development to provide additional scaffolding for the ecosystem. Resources: [Security Collab Space](https://github.com/openjs-foundation/security-collab-space), [Alpha Omega](https://alpha-omega.dev/), [OpenJS Foundation](https://openjsf.org/) ## ✅ Action Items #### Community - Contributors: finalize security policy template feedback and CPC approval process - Maintainers: review customizable security policy templates for project adoption - Sponsors: support Alpha Omega blog post creation and promotion #### OSPO - Policy & Governance: advocate for security policy adoption at CPC Wednesday meeting - Security Management: complete foundation incident response plan with stakeholder feedback - Community Engagement: coordinate with Alpha Omega on project support messaging and outreach ## 🧪 Hypotheses - Standardized security policy templates will increase vulnerability disclosure consistency across JavaScript ecosystem projects - Projects preferring security ownership over delegation indicates growing security maturity in open source maintainer communities - 14-day escalation timelines provide reasonable balance between response expectations and volunteer capacity constraints - Direct messaging outreach to projects is more effective than broad promotional campaigns for security adoption ### 📊 Methodology - Survey projects before and after security policy adoption to measure disclosure process improvements - Track escalation timeline usage and customization patterns across different project types and sizes - Compare direct outreach response rates vs. blog post/promotional campaign engagement metrics ### ❓ Questions - How will projects customize the 14-day escalation timeline based on their specific volunteer capacity and community size? - What additional security capabilities do projects want to build internally beyond incident response policies? - How can the foundation balance providing security scaffolding while respecting project autonomy? ### 🔮 Future Research - Effectiveness of security policy template adoption on actual vulnerability disclosure improvements - Relationship between project security maturity and preference for ownership vs. delegation - Optimal support models for volunteer-driven open source security practices ### 💡 Implications - Practice: Security policy templates becoming standard onboarding requirement for JavaScript ecosystem projects - Policy: CPC approval process demonstrating governance balance between foundation guidance and project autonomy - Security: Standardized escalation paths improving ecosystem-wide vulnerability coordination and CVE assignment - Education: Project preference for capability building over delegation indicating need for security training and mentorship programs ### 🧠 Learning Styles Assessment Reading level estimate: 12th grade #### 👀 Visual learners - Present: Meeting agenda structure, issue numbers and tracking - Improve: Security policy template flowcharts, escalation timeline diagrams #### 🔊 Aural learners - Present: Full meeting audio with natural discussion flow - Improve: 5-minute audio summary highlighting key decisions and next steps #### 🗣️ Verbal learners - Present: Clear policy definitions, project examples, acronym explanations - Improve: Security terminology glossary, analogy-based explanations of governance processes #### 🧩 Kinesthetic learners - Present: GitHub PR review process, hands-on policy implementation - Improve: Step-by-step security policy adoption checklist, interactive template customization guide #### 🧠 Logical learners - Present: Clear issue tracking, timeline-based escalation procedures, cause-effect policy reasoning - Improve: Decision tree for security policy customization, metrics for measuring adoption success #### 🧑‍🤝‍🧑 Social learners - Present: Collaborative meeting format, cross-project coordination discussion - Improve: Community forum for security policy implementation experiences, peer mentorship matching #### 🧘‍♀️ Solitary learners - Present: Individual project customization flexibility, self-directed policy adoption - Improve: Self-assessment tools for security readiness, independent learning resources #### 🌿 Naturalistic learners - Present: Ecosystem-wide coordination, organic project adoption patterns - Improve: Security maturity lifecycle analogies, sustainable governance practices ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear heading structure, speaker identification in transcript - Improve: Meeting role descriptions, action item labeling with ARIA #### Keyboard navigation - Present: Standard video controls - Improve: Chapter markers for key topics, keyboard shortcuts for common actions #### Contrast and readability - Present: High-contrast meeting interface - Improve: Closed captioning with speaker identification, transcript formatting #### Text resizing and reflow - Present: Responsive transcript display - Improve: Variable font sizing options, content reflow at high zoom levels #### Media and captions - Present: Full transcript available - Improve: Real-time captions during live meetings, downloadable SRT files #### Standards reference - Meets WCAG 2.2 AA for video content with transcript provision ### 🌍 DEIB Assessment #### Cultural breadth - Present: Global JavaScript ecosystem perspective, multiple time zone considerations - Improve: Translation of security policies, regional compliance considerations #### Inclusive language - Present: Technical terms defined in context, collaborative tone - Improve: Plain language security policy summaries, jargon glossary #### Neurodiversity support - Present: Structured agenda, predictable meeting format - Improve: Meeting preparation materials, visual agenda tracking #### Representation - Present: Multiple project perspectives, volunteer capacity awareness - Improve: Diverse maintainer voices in policy development, accessibility of participation #### Psychological safety - Present: Respectful discussion of project limitations, no blame for security gaps - Improve: Anonymous feedback options for security concerns, clear escalation guidelines ### ✅ Logical Validity #### Strong reasoning - Deductive strength: Template customization follows from volunteer project diversity - Inductive strength: Multiple project adoption suggests template effectiveness - Causal reasoning: Direct outreach success leads to continued similar approaches - Analogical strength: Volunteer project capacity parallels across different ecosystems #### Fallacies - Appeal to popularity: Success with few projects doesn't guarantee universal adoption, needs broader validation - False dichotomy: Ownership vs. delegation framed as binary when hybrid approaches possible #### Tone of voice - Overall tone: Collaborative and pragmatic, balancing idealism with practical constraints ### 🛡️ DARVO Analysis - Deny: No denial patterns present in security-focused collaboration - Attack: No attacks on any parties, constructive criticism of timeline rigidity - Reverse victim/offender: No victim/offender dynamics present - Emotional cues and rhetoric: Professional, solution-oriented discussion without manipulation ## 🎯 Conclusion The JavaScript ecosystem's security standardization efforts are gaining concrete momentum through the OpenJS Foundation's Security Collab Space. The key insight is that projects want security ownership and capability building rather than delegation, indicating growing maturity in the open source security community. Next steps focus on CPC approval for policy templates, creating promotional materials showcasing successful implementations, and completing the foundation-level incident response framework. This balanced approach of providing templates while preserving project autonomy appears to be the right model for sustainable security improvements across volunteer-driven open source projects. The work demonstrates how foundations can effectively support ecosystem security through coordination and resource provision rather than top-down mandates. ## 🧱 Refactor Appendix ### 📚 Literature Split Pad Purpose: Stage CEE units that become Literature notes. Split level: H3 ### [H1] Security policy templates increase JavaScript ecosystem standardization > [!quote] Security Collab Space Meeting - August 25, 2025 by OpenJS Foundation via YouTube. Published 2025-08-25. Accessed 2024-12-28. > "We are working on a lot of instant response plans to the JavaScript ecosystem." Multiple projects adopting standardized incident response frameworks with customizable escalation timelines. [view highlight](https://youtu.be/pLgWwdijTw8?t=0#H1) #security #standardization #articleseed ID:rw_001 ### [H2] Open source projects prefer security ownership over delegation > [!quote] Security Collab Space Meeting - August 25, 2025 > "They want to take ownership and we want to learn and we want to grow in this area." Projects requesting guidance and templates rather than foundation-managed security services. [view highlight](https://youtu.be/pLgWwdijTw8?t=1170#H2) #governance #ownership ID:rw --- ## Full Transcript [01:16] Hi everyone. [01:19] >> Hello. [01:20] >> Hey Kate. [01:22] >> How's it going? [01:24] >> Oh, there's Monday. [01:26] >> Yeah. [01:39] Right. [01:48] Let's see. [01:51] Let's grab the um Is anybody the host to [01:54] pause the recording? [01:57] Um, let me see if I can [02:08] I can't. Let me see if I can get the [02:09] host key. [02:45] H [02:46] >> Chris [02:49] just looking for the host key to stop [02:51] the recording or pause the recording. [03:06] Yeah. So, hello everybody. This is the [03:09] last meeting of the security open collab [03:13] space of August uh 2025. Um yeah, so [03:18] first of all, do we have any [03:19] announcements? Anything that we want to [03:21] promote? [03:26] Uh I think it's it's it's good to to [03:28] mention that uh we are working on uh a [03:32] lot of uh instant response plans to uh [03:35] the JavaScript ecosystem. So we have [03:37] like drafts for uh Webpack message [03:40] format [03:42] uh for fastfi uh they are all discussing [03:46] uh having this this document align with [03:49] the the minimal we have on on the uh [03:54] security collab space. So I think it's [03:57] good to announce that people are looking [03:58] to it. [04:00] >> Yeah. [04:02] you know, and we still we have that free [04:04] JavaScript security training. I should [04:07] pull some data from that. We had we've [04:09] just launched it not too long ago, but [04:11] um we should keep promoting that [04:14] wherever and however we can. Yeah. [04:19] >> Yeah. Also, there's like potentially [04:21] other two projects. We have a meetings [04:23] meeting with them and this week, which [04:25] is going to be am [04:27] script. So yeah, potentially we try to [04:29] convince them follow the path and and [04:32] try to also have one. So that will be [04:34] good. [04:37] >> That's awesome. [04:37] >> Okay. Um yeah, let me jump to the [04:41] agenda. So uh let me see what what we [04:43] have in the agenda today. Um let me pass [04:46] the link of the issues that they have [04:50] that we have with the security agenda [04:52] label on [04:54] unless we want to tackle something [04:56] priority first. [05:03] Okay. Um, so then we're going to start [05:06] with the I think is the 290 [05:09] uh which is uh from Rafael and it's [05:13] about uh let me have a look um security [05:16] policies [05:18] for the project before the boarding. [05:24] Oh yeah. Uh I think in the last session [05:28] we have discussed okay uh this is the [05:30] minimal let's open the progress and get [05:31] feedback on on that request. So I have [05:34] posted the uh what what I had in mind [05:37] and then I opened the request to the CPC [05:40] and we got some uh we got an approval [05:43] from uh Blisses and also um [05:48] um a comment from Toby uh which is uh [05:54] maybe merge the documents with the [05:56] project secured reporting. uh I don't [05:59] think that uh there is a objection uh to [06:03] to the to this the current format of the [06:05] document. It's more about merging the [06:07] existing documents with the ones we have [06:09] provided. But I think I'll take a look [06:12] on that today and make the just [06:21] >> I think the chat requests. [06:24] >> Awesome. I think probably we can um [06:27] advocate a bit for this topic on the on [06:30] the CPC meeting on Wednesday. It is not [06:32] a work session. It's a regular session. [06:34] So maybe we can try to get enough [06:36] traction and try to land it. That will [06:38] be great because then we can start doing [06:40] PRs to the project updating the security [06:43] MD and so on. So that will be that will [06:46] be great. [06:48] Yeah. I also would mention that we [06:49] included like um an escalation path to [06:52] the CNA and some recommendation in terms [06:56] of timing for waiting before escalating [06:58] to the CNA as well uh just in case. So [07:01] yeah, worth also asking uh Chris and [07:03] Jordan to have a look on this. But yeah, [07:06] it was very aligned to the previous one [07:07] which is 14 days in case of um no [07:10] answer. [07:15] Um, [07:18] yeah, I'm not a big fan of putting day [07:21] timelines in for [07:24] volunteer-led projects. Um, [07:28] I I think, [07:32] you know, I don't know, people are going [07:33] to have different [07:35] again, it's a template, so so people can [07:37] customize, right, and and set it to what [07:40] they want. Although that is slightly [07:44] not the case if you know folks want to [07:49] um proceed with one of Toby's ideas [07:52] which was to [07:55] like have people actually point directly [07:57] to the template. Um I I I don't think [08:01] that that's a great idea, but um I'm [08:05] just trying to be thorough in what we're [08:07] considering here. And that's obviously [08:10] also a separate thing. Um [08:14] I don't know what we focus on. [08:23] I think we can add a note and and [08:25] mention that the that the dates are [08:27] orientative and customizable per [08:30] project. I I remember the discussion [08:31] like we have a similar discussion [08:33] express time ago when we did the I think [08:36] it was in terms of of when the people [08:39] may expect to act the message and [08:41] replies and and stuff. Um so I think [08:44] that's going to be like super [08:45] customizable by the for the projects. So [08:47] I don't expect two projects to have the [08:49] same deadlines, right? Uh but yeah, I [08:51] think 100% depend on the project but [08:53] maybe we can make that super clear. So [08:55] there is no like uh expectations from us [08:58] or from the foundation that you know you [09:00] should reply on X time or just go for [09:02] escalation, right? Um so yeah also yeah [09:06] project should be comfortable with this [09:07] anyway, right? That's the expected [09:11] but yeah we can we can probably save [09:12] this on the on the CPC meeting. That [09:15] might be one of the most uh controver [09:18] controversial points of the policy. I [09:20] guess the other in terms of a structure [09:22] and so on. I think we are pretty aligned [09:24] right. [09:30] Okay. See yes faces. [09:32] Okay. [09:38] Okay. Yeah, I happy to jump to the next [09:41] topic in the agenda [09:44] which is if I'm not mistaken um issue [09:47] 291 which is related to the create media [09:51] about the support of alpha mega which is [09:54] basically the idea of trying to generate [09:57] more uh traction around the projects and [09:59] stuff. I think we uh did some uh like uh [10:05] DM uh approach right now and it has been [10:08] working good recently with the project. [10:10] So from that front I think we are kind [10:11] of okay at this moment. But if I recall [10:14] correctly last time we have been [10:15] discussing a little bit on the on the [10:16] next town hall. So maybe we can present [10:19] some uh some topics regarding security [10:22] the CNA and stuff like that to the [10:24] project. That was the idea if I recall [10:26] correctly. But but yeah, [10:28] >> uh I think that uh last meeting we have [10:31] discussed about um asking asking Kylie [10:34] for a more specific blog post so we can [10:37] publish and uh inform like uh OpenJS [10:41] projects that okay if you want you can [10:43] get some guidance from the alpha omega [10:45] project. Uh but Kylie was in uh PDO so [10:49] uh I think we still need to to ping her [10:52] and uh ask for for for help on this on [10:56] this part. Uh yeah, other than that I [11:00] think that's that's it. [11:01] >> Yeah, we have a team meeting today. So I [11:04] put it on our agenda. Um I know we have [11:06] a regular meeting with you Rafa. I don't [11:09] know if that's coming up on note if we [11:11] want to extend it but with Kylie [11:14] >> otherwise we can set something up [11:15] separately easily. [11:18] >> Yeah, I think it can be uh uh separate [11:21] uh so we could point all the folks to [11:24] the same blog post every time. [11:26] >> Okay, cool. [11:34] I actually like you sort of summarized I [11:36] believe for ESLint what in your little [11:38] introductory post to them what you you [11:41] know I think that's a good starting [11:42] point. So maybe I'll just have her even [11:44] take a stab [11:46] >> at some of the work. [11:47] >> Yeah, I think yes we could mention uh [11:50] the the project that started doing the [11:52] the work like Webpack yes link uh as a [11:56] showcase to the blog post. Yes, that [11:58] makes sense. [11:59] >> Okay. All right. [12:01] I don't think we really need a meeting. [12:02] Why don't we just take a stab at it? [12:04] >> Yeah. [12:05] >> Okay. [12:06] >> Cool. [12:12] >> Okay. I think next topic in the agenda [12:15] uh is 285 which is related to align [12:19] project with minimum security reporting [12:21] guidelines. [12:22] Um let me see. Yeah, this has been [12:26] discussed in the past. I think we don't [12:28] have like a lot of update here uh here [12:31] in one hand it's like to be sure that [12:32] the project has the security MD in place [12:34] and stuff like that which it's going to [12:37] be probably good driven now that we will [12:40] expect to land the PR of Rafael on the [12:42] CPC meeting this week so probably that's [12:45] going to be like the entry door for us [12:47] on this uh but the discussion here was [12:50] also more about what are the actually [12:52] minimal minimal templates uh for the [12:54] project because I think right now we [12:56] have like a lot of [12:57] uh on the minimal version that we did in [12:59] the past. So probably I think that's um [13:03] that is ongoing discussion and that can [13:06] be a sync I think. Hi Jordan. [13:08] >> Okay. So tomorrow hi Jordan. Tomorrow is [13:11] a working session. So I think we should [13:13] just yeah just get more folks to weigh [13:14] in on it during the working session and [13:16] then bring it for a broader discussion [13:19] at the CPC the next weeks. [13:21] >> Okay. [13:22] >> Yeah. [13:25] Yeah. And I think the last one is the [13:28] 286 [13:30] uh which is related to the delegation um [13:34] of 13 security activities from the [13:37] project into the foundation. Uh so far [13:40] we have reached a lot of projects. The [13:42] idea here was to validate uh first of [13:44] all if the project are actually willing [13:46] to you know do this kind of delegation [13:48] into you know uh the foundation somehow [13:50] and based on that idea let's see how we [13:53] can cover that needs right. Um so far [13:55] when we started the discussion with the [13:57] brand with the project they didn't you [13:59] know first thing trying to give us this [14:02] responsibility it was more like we want [14:03] to take ownership and we want to learn [14:05] and we want to grow in this area and so [14:07] on. So probably uh my my feeling at this [14:10] point is probably we don't need this [14:12] idea of delegation right now and if [14:14] appears in the future we can just [14:16] reopen. So probably we can close the [14:17] issue and go ahead as as we are if we [14:22] are all happy with this idea. [14:29] Okay. Um seems like we are running this. [14:32] Uh let me see. [14:35] Um I think also there are um um yeah [14:39] there is the aside of this this is the [14:41] issue just to get some traction as we [14:44] have a good forum today. Um the PR 289 [14:48] which is related to the foundation [14:50] incident respond plan. Uh the idea is [14:53] more to keep the a sync discussion there [14:55] but just to bring more eyes. I got a lot [14:57] of feedback from from Steve and from Ben [14:59] already on this PR. So it will nice if I [15:02] can get like uh more feedback especially [15:04] from probably Jordan, Chris uh and so on [15:06] on this uh and yeah I I plan to work [15:09] deeply uh probably on this tomorrow. So [15:12] I will add more comments and try to [15:14] resolve some of the discussions on [15:16] going. But yeah, so far has been uh [15:18] getting a lot of traction from and a lot [15:20] of comments. So I'm very happy with this [15:21] PR [15:24] and I think uh from my side I think that [15:26] was more or less the topics that they [15:28] have for the agenda. Not sure if anyone [15:30] has any additional topic to cover. [15:46] Okay, take that as a no. And this is in [15:49] the account that today is Monday. Uh are [15:51] we happy to get back some time to folks [15:54] to doing more things and stuff? [15:57] >> Great work you all. Thank you. [15:59] >> Thank you. [16:00] >> Thanks everyone. Bye. [16:02] >> See you.