OSPS-VM-03 Maintain Private Vulnerability Reporting Process (maturity levels 2, 3). Requirement: The project documentation MUST provide a means for private vulnerability reporting directly to the security contacts within the project. Objective of the control: Provide a means for reporting privately to the security contacts within the project so that security vulnerabilities are not be shared with the public until the project has been provided time to analyze and prepare remediations to protect users of the project. Recommendation: Provide a means for security researchers to report vulnerabilities privately to the project. This may be a dedicated email address, a web form, VCS specialized tools, email addresses for security contacts, or other methods.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.