Security Collab Space Meeting - November 17, 2025

Security Collab Space Meeting - November 17, 2025 🔗 **Source:** [Security Collab Space Meeting - November 17, 2025](https://www.youtube.com/watch?v=Lxqvp5frIOc) > [!note]+ Document Notes > tags: [security, openjs, collaboration] > author: OpenJS Foundation > source: YouTube > reference: https://www.youtube.com/watch?v=Lxqvp5frIOc > date created: 2024-12-19 10:30 > > # 🏷️ Title: OpenJS Security Collab Space Meeting - November 17, 2025 >  ## 🧰 Action Inbox - [H1] Create issue with subtasks for Command Center public release — this week #security - [H2] Review and merge ARP PR — by tomorrow morning #development - [H3] Establish source of truth for project contact information — ongoing #infrastructure ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [OpenJS Foundation](https://openjsf.org/) - [OpenSSF](https://openssf.org/) - [Alpha Omega](https://alpha-omega.dev/) ## 📝 Summary - OpenJS Security Collab Space weekly meeting covering three main initiatives - Successfully published npm security guidance blog post last week - Command Center dashboard ready for public release with contact information cleanup needed - Active development on ARP (Automated Response Protocol) with PR ready for merge - Establishing better coordination with OpenSSF and Alpha Omega initiatives ## 📖 Main Content The OpenJS Security Collab Space is advancing multiple security initiatives simultaneously. The team successfully published comprehensive guidance on "Publishing Securely on NPM" following collaborative work that began at the collab summit. This effort demonstrates effective cross-team coordination and provides practical security guidance for the JavaScript ecosystem. The Command Center project represents a significant infrastructure advancement, featuring a dashboard that tracks project adherence to security best practices. However, the transition to public visibility requires resolving contact information management challenges, as the current system lacks a single source of truth across Google Docs, GitHub, and internal systems. Development work continues on the Automated Response Protocol (ARP) with a pull request nearing completion. The team emphasizes iterative development, prioritizing initial deployment over perfect implementation. ## 🗒️ Notes #### ⏱️ [00:00](https://youtu.be/Lxqvp5frIOc?t=0) — [H1] Meeting Opening and Agenda Review - Key idea: November 17th Security Collab Space meeting with multiple agenda items - Evidence: "Welcome to the Monday, November 17th meeting of the OpenJS Security Collab space" #### ⏱️ [01:30](https://youtu.be/Lxqvp5frIOc?t=90) — [H1] OpenSSF Attestation Style Guide Discussion - Key idea: Unassigned agenda item requiring clarification on ownership - Evidence: "I'm not sure who added that, but I'll post the link in chat" #### ⏱️ [02:15](https://youtu.be/Lxqvp5frIOc?t=135) — [H1] NPM Security Blog Post Success - Key idea: Successfully published comprehensive NPM security guidance - Evidence: "It went out on Friday, I believe... great work from everybody in this collab space" #### ⏱️ [03:30](https://youtu.be/Lxqvp5frIOc?t=210) — [H2] GitHub Product Team Collaboration - Key idea: Blog post provides valuable feedback for GitHub product improvements - Evidence: "We are working closely with GitHub to advocate for product changes" #### ⏱️ [04:00](https://youtu.be/Lxqvp5frIOc?t=240) — [H1] Command Center Public Release Planning - Key idea: Ready to make Command Center public with contact cleanup needed - Evidence: "I wanted to talk more about the command center and moving forward on getting this public and announced" #### ⏱️ [05:00](https://youtu.be/Lxqvp5frIOc?t=300) — [H2] Contact Information Source of Truth Challenge - Key idea: Multiple inconsistent contact sources create operational challenges - Evidence: "Source of truth for contact information for projects is squishy" #### ⏱️ [06:15](https://youtu.be/Lxqvp5frIOc?t=375) — [H3] Private Repository Solution Proposal - Key idea: Centralized private repository for all project contact and social media information - Evidence: "Create a private report for contact information... include social media for the projects" #### ⏱️ [08:00](https://youtu.be/Lxqvp5frIOc?t=480) — [H2] Command Center Requirements Discussion - Key idea: Need CPC mandate for security best practices adherence levels - Evidence: "We don't have any type of requirement for projects... do we want to add in some requirements" #### ⏱️ [10:30](https://youtu.be/Lxqvp5frIOc?t=630) — [H3] Project Status Integration Needs - Key idea: Tooling dependencies require project status change notifications - Evidence: "Some of the toolings that we have depend on the status that your project has" #### ⏱️ [12:00](https://youtu.be/Lxqvp5frIOc?t=720) — [H3] Node.js Support Documentation Reference - Key idea: Existing Node.js support documentation provides vetted template - Evidence: "Node project actually put together a support doc... that documents both contact information for maintainers" #### ⏱️ [14:00](https://youtu.be/Lxqvp5frIOc?t=840) — [H3] ECMA Specification Development - Key idea: Potential standardization opportunity through ECMA spec work - Evidence: "Working on something this area with an ECMA spec" #### ⏱️ [15:30](https://youtu.be/Lxqvp5frIOc?t=930) — [H2] ARP Pull Request Status - Key idea: ARP implementation ready for final review and merge - Evidence: "I have this PR open for the ARP for a while... I think I solved all the critical comments" #### ⏱️ [17:00](https://youtu.be/Lxqvp5frIOc?t=1020) — [H2] Alpha Omega Meeting Coordination - Key idea: Better cross-pollination with Alpha Omega and OpenSSF meetings - Evidence: "Getting some visibility into some of the meetings that they have that might be useful for us to attend" #### ⏱️ [18:30](https://youtu.be/Lxqvp5frIOc?t=1110) — [H3] MDN Security Guide Updates - Key idea: Opportunity to contribute updated security guidance to MDN - Evidence: "They're updating MDN security guides and we they didn't have any really updated information from us" ## 📚 References - [OpenJS Foundation Security Collab Space](https://github.com/openjs-foundation/security-collab-space) - [OpenSSF](https://openssf.org/) - [Alpha Omega Initiative](https://alpha-omega.dev/) - [MDN Web Docs](https://developer.mozilla.org/) ## 🗣️ Paraphrase - The OpenJS Security Collab Space successfully published important NPM security guidance and is preparing to launch their Command Center dashboard publicly - The team faces infrastructure challenges around maintaining consistent project contact information across multiple systems and needs to establish a single source of truth - Development work continues on automated response protocols while the team seeks better coordination with related security initiatives like OpenSSF and Alpha Omega ## 📰 Newsletter The OpenJS Security Collab Space is making significant progress on multiple fronts! Last week saw the successful publication of comprehensive NPM security guidance, building on collaborative work that started at the collab summit. This represents exactly the kind of practical, community-driven security resources our ecosystem needs. Coming soon is the public launch of the Command Center - a dashboard tracking security best practices across OpenJS projects. This transparency initiative will help projects understand and improve their security posture while providing valuable ecosystem-wide visibility. The team is also advancing automated response protocols and seeking better integration with broader security initiatives like OpenSSF and Alpha Omega. These cross-organization efforts help prevent duplicated work and maximize impact. Resources: [OpenJS Security Collab Space](https://github.com/openjs-foundation/security-collab-space), [OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/), [NPM Security Guidelines](https://docs.npmjs.com/about-audit) ## ✅ Action Items #### DevRel - Developer advocacy: Share Command Center publicly to demonstrate security transparency - Education: Leverage NPM security blog post for workshops and training materials - Developer experience: Integrate security best practices into onboarding documentation - Community management: Coordinate with OpenSSF and Alpha Omega for broader ecosystem engagement #### OSPO - Policy & Governance: Develop CPC requirements for security best practices adherence - Security Management: Establish Command Center as operational security dashboard - Software Inventory: Create centralized project contact information repository - Developer Support: Provide security guidance consultation through published materials - Community Engagement: Participate in OpenSSF and Alpha Omega coordination meetings - Strategic Alignment: Track security KPIs through Command Center dashboard #### Community - Maintainers: Support project security improvements through Command Center feedback - Contributors: Enable security contributions through ARP automation - Ecosystem: Coordinate security initiatives across JavaScript foundation projects #### OpenJS Foundation - Foundation: Launch Command Center publicly with CPC approval and communication - Projects: Establish security requirements for project graduation levels - Infrastructure: Implement single source of truth for project contact information - Security: Complete ARP implementation for automated incident response - Documentation: Update MDN and other external security guidance with current practices - Coordination: Regular participation in OpenSSF and Alpha Omega initiatives ## 🧪 Hypotheses - Centralalized contact information repository will improve incident response times and project coordination effectiveness - Public Command Center dashboard will incentivize projects to improve security practices through transparency - Standardized security requirements for project graduation will raise baseline security across the foundation - Cross-organization coordination with OpenSSF and Alpha Omega will reduce duplicated effort and increase impact ### 📊 Methodology - Measure incident response times before and after contact information centralization - Track security practice improvements following Command Center public launch - Survey project maintainers on security requirement impact and burden - Document collaboration outcomes and resource sharing with partner organizations ### ❓ Questions - What specific security practice adherence levels should be required for different project tiers? - How can the Command Center dashboard balance transparency with project privacy concerns? - What coordination mechanisms would be most effective with OpenSSF and Alpha Omega initiatives? ### 🔮 Future Research - Automated security practice assessment and reporting capabilities - Integration between Command Center and external security scanning tools - Cross-foundation security practice standardization opportunities ### 💡 Implications - Practice: Foundation projects will have clearer security expectations and support - Policy: CPC governance will include security requirements for project advancement - Security: Improved visibility and response capabilities across the JavaScript ecosystem - Education: Public dashboard creates learning opportunities for security best practices - Funding: Security infrastructure investments demonstrate measurable ecosystem improvements ### 🧠 Learning Styles Assessment Reading level estimate: 12th grade #### 👀 Visual learners - Present: Meeting structure, dashboard concept - Improve: Command Center dashboard screenshots, security practice visualizations #### 🔊 Aural learners - Present: Full meeting recording available - Improve: Key takeaway audio summary, security guidance podcasts #### 🗣️ Verbal learners - Present: Technical term explanations, acronym definitions - Improve: Security practice analogies, real-world incident examples #### 🧩 Kinesthetic learners - Present: ARP implementation work, hands-on security improvements - Improve: Security assessment checklists, step-by-step hardening guides #### 🧠 Logical learners - Present: Systematic approach to contact management, clear project requirements - Improve: Security practice decision trees, risk assessment frameworks #### 🧑‍🤝‍🧑 Social learners - Present: Collaborative meeting format, cross-organization coordination - Improve: Security working groups, peer review processes for improvements #### 🧘‍♀️ Solitary learners - Present: Individual task assignments, self-directed implementation work - Improve: Self-assessment tools, independent security study materials #### 🌿 Naturalistic learners - Present: Ecosystem-wide security thinking, interconnected project relationships - Improve: Security threat landscape analysis, ecosystem health metrics ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear heading structure in notes, descriptive action items - Improve: Video transcript formatting, better link descriptions #### Keyboard navigation - Present: Standard web meeting accessibility - Improve: Dashboard keyboard navigation design considerations #### Contrast and readability - Present: Clear text formatting in documentation - Improve: Command Center dashboard contrast requirements #### Text resizing and reflow - Present: Responsive note formatting - Improve: Dashboard responsive design planning #### Media and captions - Present: Full meeting transcript provided - Improve: Professional captions, speaker identification #### Forms and interactions - Present: Basic meeting interaction accessibility - Improve: Dashboard form accessibility requirements #### Standards reference - Future dashboard development should meet WCAG 2.2 AA standards ### 🌍 DEIB Assessment #### Cultural breadth - Present: International foundation scope, global security concerns - Improve: Multi-timezone meeting considerations, regional security examples #### Inclusive language - Present: Professional technical communication - Improve: Define technical acronyms, avoid insider jargon #### Neurodiversity support - Present: Structured meeting format, clear action items - Improve: Meeting summaries, consistent agenda formatting #### Representation - Present: Collaborative decision-making, multiple contributor voices - Improve: Diverse security expert perspectives, inclusive leadership examples #### Psychological safety - Present: Supportive feedback culture, iterative development approach - Improve: Clear escalation paths, welcoming contributor onboarding ### ✅ Logical Validity #### Strong reasoning - Deductive strength: Contact information centralization improves incident response - Inductive strength: NPM security blog success indicates community need for practical guidance - Causal reasoning: Public dashboards incentivize security improvements through transparency - Analogical strength: Node.js support documentation model applicable to broader foundation projects #### Fallacies - Appeal to authority: Relying on existing Node.js documentation without critical evaluation - Hasty generalization: Assuming dashboard transparency will improve all project security practices #### Tone of voice - Overall tone: Collaborative and pragmatic, focused on practical implementation over perfect solutions ### 🛡️ DARVO Analysis - Deny: No denial patterns present - transparent discussion of challenges - Attack: No attacks on contributors or external parties - Reverse victim/offender: Not applicable - security-focused technical discussion - Emotional cues and rhetoric: Professional, solution-oriented, collaborative tone throughout ## 🎯 Conclusion The OpenJS Security Collab Space demonstrates effective collaborative security governance through practical initiatives like the NPM security guidance and Command Center dashboard. The transition to public transparency while maintaining operational effectiveness requires careful attention to infrastructure details like contact management. Success depends on balancing security requirements with project autonomy and ensuring coordination with broader ecosystem security initiatives. ## 🧱 Refactor Appendix ### 📚 Literature Split Pad Purpose: Stage CEE units that become Literature notes. Split level: H3 ### [H1] Command Center enables security transparency > [!quote] Security Collab Space Meeting by OpenJS Foundation via YouTube. Published 2025-11-17. Accessed 2024-12-19. > "We have a dashboard that's showing adherence to various best practices." Public security dashboards can incentivize improvements through transparency. [view highlight](https://youtu.be/Lxqvp5frIOc?t=480#H1) #xref #security ID:rw_command_center ### [H2] Contact information fragmentation creates operational risk > [!quote] Security --- ## Full Transcript [00:00] Morning [00:03] everyone. Welcome to the Monday, [00:05] November 17th meeting of the OpenJS [00:08] Security Collab space. Got a couple of [00:10] um interesting things on the agenda for [00:13] today. Uh first one um this was added is [00:18] a the open SSF attestation style guide. [00:21] So I'm not sure who added that, but I'll [00:23] post the link in chat. [00:29] Wonder if Raphael posted this one. Is [00:31] this ringing a bell for anyone? [00:35] >> No. [00:40] >> What issue number is that? [00:43] >> It's not an issue. It's a It's a link to [00:45] a document. [00:46] >> Okay. I just put it in chat. Um I'm not [00:50] sure. Well, maybe we'll come back to [00:53] this if anyone else pops in. [00:55] Is anyone familiar with this? [01:00] >> Nope. [01:01] >> Nope. Okay. Well, this is also a [01:04] reminder that going forward, if you do [01:06] add something to the agenda, please pick [01:08] your name. Oh, I know who to call. [01:15] Okay. [01:16] Uh, next up here is the Open JSF blog [01:21] post publishing securely on npm. This [01:24] one went out last week. [01:26] >> Yep, it went out on [01:30] um Friday, I believe. Gosh, the days are [01:33] blurred. So, yeah. Um great work from [01:36] everybody on in this collab space um and [01:39] helping that come together. I think that [01:42] even started at the collab summit, [01:44] right, with the GitHub repo with more [01:46] guidance. So, really big team effort [01:48] here. Um, we saw new security issues [01:52] happen over the last week as well with [01:54] npm. So, I think you all are doing great [01:56] work. So, congrats. We're getting that [01:59] out. And we'll, um, as the product [02:02] changes, um, I did hear, you know, we [02:04] are working closely with GitHub to [02:06] advocate for product changes. Um, I [02:08] think these blog, you know, the blog and [02:10] and I know we had a draft earlier is [02:12] sort of helping, um, provide that [02:15] feedback that their product team needs. [02:17] So, let's keep it going. [02:25] >> Okay, I added the next one here. Um, I [02:27] wanted to talk more about the command [02:28] center and moving forward on getting [02:30] this um public and announced. So, I [02:35] think um I'll create an I don't think we [02:37] have an issue tracking this, but I'll [02:39] create an issue with subtasks for this [02:41] because I think I pretty much know what [02:42] needs to be done here. Um, [02:46] and I think I'd like to try and do do [02:49] this this week. So, the main task there [02:52] is um removing the uh contact emails for [02:57] our projects. Um, this is actually a um [03:01] an interesting one because source of [03:04] truth for [03:06] contact information for projects is um [03:09] is squishy. So um we have [03:14] uh like a Google doc that was created [03:16] part as part of our infrastructure work [03:19] but it hasn't been update kept up to [03:21] date. Um there's information in GitHub [03:24] and there's information here. So this is [03:26] actually really important because we we [03:28] do at times need to reach out to our our [03:31] projects. So, I think as part of this, [03:33] I'd like to really establish a source of [03:35] truth um so that if we're ever making [03:38] updates, there's there's one spot uh for [03:41] those email addresses. Uh yes, Ulyses. [03:44] >> Yeah, I was thinking that maybe we can [03:47] um create a private report like for for [03:50] contact information and we can go ahead. [03:52] I mean, not just security, we can [03:54] include for example social media for the [03:56] projects, you know, this kind of things. [03:57] So you have all the links handy in one [04:00] place aside of a specific individuals, [04:02] right? So in case that you want to track [04:04] other projects when you join the [04:06] foundation and things like that, you [04:07] already have everything there in one [04:08] place. So it's super easy also to get in [04:10] touch with someone. So I think that [04:12] might be interesting and the people can [04:14] autoop populate that or just the project [04:15] or whatever and it's all based on PR. So [04:18] that's an easy way of handling this long [04:21] term. [04:22] >> I like that idea a lot. Um, part of the [04:24] challenge here was trying to get the the [04:26] projects to self curate this uh because [04:30] it's it's very difficult for us [04:31] obviously. So I think this will this [04:33] might help that. So okay [04:36] um once we do that then I think we're [04:38] pretty much good to convert the private [04:41] repo to a public repo. Uh and then we [04:44] have to make people aware of it. And so [04:47] um we'll add it to a CPC call agenda [04:50] probably in [04:53] first week in December if that's not a [04:54] working group. Uh and then after we'll [04:56] email the list the the sorry the CPC [04:59] email list to make sure folks are aware. [05:02] What we don't have is any type of um [05:07] like requirement for projects. So what I [05:10] mean by that is we have a um a dashboard [05:13] that's showing adherence to various best [05:15] practices but we don't have a mandate [05:18] from the CPC that uh projects need to [05:20] maintain a specific [05:22] um level. So I think that's going to be [05:25] the next thing is like okay like do we [05:27] want to add in some requirements for um [05:31] maybe for coming into the foundation [05:33] like you must have this this level and [05:35] then even for if you want to graduate to [05:37] say an impact project or something do [05:39] you do we want to say okay if you want [05:41] to be an impact project then we need [05:43] adherence to these additional best [05:45] practices something like that so I think [05:47] that's that's kind of what I want to um [05:50] discuss in the CPC call is that's kind [05:52] of the next step in operationalizing [05:54] This is like let's actually make this [05:55] something that projects need to adhere [05:57] to. [06:03] >> I know Ulyses wants to work on this with [06:05] me. Um does anyone else want uh [06:09] >> I will work on this with Rafa probably. [06:11] He he was off today. This was her [06:14] birthday during the weekend. Uh but yeah [06:15] basically uh we will actually need that [06:18] step because uh for us for example some [06:21] of the toolings that we have depend on [06:22] the on the status that you that your [06:25] project has and so on. So it will be [06:27] useful for us to keep in touch. I mean [06:30] obviously right now we are super active [06:31] on the CPC meeting so we know when when [06:33] people are changing stuff but it makes [06:36] sense if we include as a part of the [06:37] process just you know open an issue and [06:39] say like this project is going to change [06:40] soon and I think that's already enough [06:43] and maybe for the boarding we can go a [06:44] little bit more deeper but yeah I think [06:46] I think that's all for us so we can [06:48] update the tooling easily [06:54] >> oh sorry Darcy [06:56] >> yeah I shared the link uh the package uh [06:59] in this working group um that was spun [07:01] out of the node project actually put [07:04] together a support doc a number of years [07:06] ago that um documents both contact [07:10] information for maintainers as well as [07:12] like the level of support you can expect [07:14] for from the project. And so this [07:17] document was pretty well vetted by a a [07:21] number of folks and was obviously [07:23] designed and contributed to to kind of [07:26] address at least like um expectations to [07:30] try to like communicate expectations for [07:32] projects. Um so it might be a good [07:35] resource to either pick ideas from or [07:39] steal or copy exactly what was being [07:42] done there. um uh whether or not it's [07:45] something that you want to keep private [07:47] or public, but it's essentially was [07:49] there to try to help um address a bunch [07:52] of the missing information that isn't [07:54] sort of documented in package JSON and [07:56] and more um yeah support docs. Um I see [08:01] Wes also noted something about this. [08:04] >> Yeah. Um working on something this area [08:06] with an ECMA spec. So what would be the [08:10] scope of that spec? [08:18] I I can also just reach out to him. Um [08:21] Wes, but that's interesting. [08:24] Let me just copy your note here. Sorry, [08:27] Wes. No worries. Um no worries. We have [08:32] enough and it will reach out to Jordan. [08:37] See? [08:41] >> Yeah. Like what you're looking for is [08:42] essentially bless metadata that [08:44] everybody's using, right? So yeah. [08:47] >> Yeah. Let me just add this to the notes. [08:49] Uh [08:51] chat [08:56] >> Wes, I had the same technical issues on [08:58] audio this morning. I I just dropped and [09:01] rebooted. It's helped some. So, [09:06] not rebooted, just dropped and restarted [09:09] Zoom. [09:12] >> I think Jordan is in Asia this week. So, [09:15] so we'll touch base [09:16] >> for Yeah. TC39. [09:18] >> Yeah. So, we'll touch base with him [09:20] about this um over Slack. That's [09:22] interesting. Yeah, that would be great [09:25] if there's like an actual standard being [09:28] developed for some of this stuff. That [09:29] would be super useful because we're [09:30] we're kind of just going a little um you [09:34] know free [09:36] free uh cowboy style. Okay, we'll [09:40] definitely talk with that. All right. [09:42] Anything else about the command center [09:43] stuff? [09:48] Cool. [09:50] Uh Ulyses, you want to talk about what [09:53] you're just typing in there? Yeah, I [09:56] have this PR open for the for the ARP [09:59] for a while. Um, I think I solved all [10:01] the critical comments. I think that was [10:03] one regarding the forms and stuff that [10:05] we solved it, but I see some comments on [10:06] the comments and stuff. So, I was I was [10:08] just wanted to be sure that we are all [10:10] happy on landing this first version. Uh, [10:13] so I can start iterating on the next one [10:14] on separate PR. [10:18] >> Yeah, I think this is good. I'll I'll [10:19] take another look at uh another look at [10:21] this today. Um, but yeah, when I looked [10:23] at it, I only saw minor stuff and again, [10:25] I think as a first version, it's it's [10:27] more important to get get this out. [10:30] >> Okay. Yeah, I I will I will try to merge [10:32] it tomorrow on my morning so you have [10:34] plenty of time to check. Okay. [10:39] >> And yeah, anyone else on the call, [10:40] please please review um add your [10:42] comments today so that we can get it up [10:44] tomorrow. [10:48] Okay. [10:49] Uh before a lot of you came on, we were [10:52] talking with Kate a little bit about [10:53] Alpha Omega and getting some getting [10:56] some visibility into some of the [10:58] meetings that they have that might be [10:59] useful for us to attend. So in a future [11:02] call, we'll kind of have a um a list of [11:04] those um then if folks are interested um [11:07] they can join. But I'd like to do a [11:09] little bit of a better job um attending [11:12] some of the meetings that might be [11:13] relevant for for our team and also just [11:15] providing feedback. like it seems like [11:17] there's there's some overlap in some of [11:19] the initiatives we're doing. So, that's [11:21] a good a good way of um [11:23] cross-pollinating stuff. [11:25] >> Yeah. Open SSF as well, correct? Yeah. [11:27] >> Yeah. Open SSF as well. Yeah. [11:30] >> Kate, are you on [11:34] >> Are you on both of those? Open SSF and [11:36] alpha or just you are. Okay. [11:40] >> Yeah. Sometimes I'll find opportunities [11:42] in Slack and flag it. Like I just saw [11:44] that, you know, they're updating MDN [11:46] security guides and we they didn't have [11:48] any really updated information from us. [11:51] So yeah, [11:53] >> my old friends MDN. [11:55] >> I know actually. Yeah. [11:58] >> Oh, that's great. [11:59] >> It's just always good to catch things [12:00] and make sure that our Yeah. content [12:02] scales through them. So [12:04] >> yeah. Yeah. [12:08] Where should I open [12:13] Okay. Anything else from folks? Because [12:16] that's kind of the official agenda. [12:26] Darcy, Steve, anything that you're [12:29] working on currently that might be [12:30] relevant you want to share? [12:34] >> Not yet, but very soon. [12:39] that I'm allowed [12:40] >> that I'm allowed to talk about. [12:42] >> A I know. I'm sure Capital One is [12:44] working on a lot of interesting stuff, [12:46] but yeah, I understand. [12:49] >> Okay. [12:49] >> Behind the firewall. Behind the fire. [12:52] >> Yeah, no worries. All righty. Well, uh [12:56] in that case, um we'll work on the [12:59] command center and we'll also work on [13:02] the IRP. We'll get some additional [13:04] meetings here. And yeah, things are [13:06] going well. [13:08] All right. Uh, as always, reach out via [13:10] Slack if you need anything. And, um, on [13:13] that note, if there's nothing else, we [13:14] can adjourn. [13:16] Thanks, everyone. [13:18] >> All right, folks. Always good to see [13:20] you. Bye.