hey team! not sure if this is the right place to ask this question in zach's absence this week: https://github.com/osquery/osquery/security -> does the committee have a best practice or guideline that's followed for surfacing and remediating vulnerabilities or is it by report only? do you surface criticals and highs only? is this document up to date to share with community members?

Are you asking how we disclose things, or how they are disclosed to us?

Hey @seph! Thanks for the answers. Yes, I work for Fleet. I know we proactively tackle "Critical" vulnerabilities and possible "High" as well if we get to them first. I'm wondering if there's an automated flow that surfaces vulnerabilities in osquery and if they are proactively addressed by members of this committee or if it is all community driven (either via contribution or specifically requesting that a CVE be remediated if an applicable non-vulnerable version exists)

This committee is still community driven.

Haha no not at all. Just had a customer asking what the processes are and I know what they are for Fleet but didn't want to speak for what's done by the committee/community

This can be a tension point -- Fleet is a business and can assert it does things to customers. Osquery is a volunteer project, so we try not to make commitments. Fleet is part of the osquery project, and fleet can commit to doing things with osquery.

Makes perfect sense. I can draft my response based on that. Thank you so much

I also see that Lucas is planning to talk about those potential issues today.

Yes - all a result of the question from the same customer I'm referencing

But without doing analysis, it's hard to know if they matter. Just because some library osquery uses has a "critical", doesn't mean the underlying issue has any impact on osquery whatsoever. We do often try to fix them, but at least partly to so that the various automated scanners make less noise.

100%.