[SEC-WG] Define a security budget

[evenstensberg]

[bjohansebas]

For example, Express is applying to the Sovereign Tech Resilience program it’s still in progress, but the foundation is partnered with Sovereign Tech. Node.js/Electron use the IBB bug bounty, which is on HackerOne. I’m not sure what other programs there are, but those are the ones I have some idea about and know that other foundation projects are in or applying to

I also mentioned this briefly on Discord in the TSC channel

[evenstensberg]

@ovflowd could you apply for webpack to the soverign tech resillience program?

[ovflowd]

Sure can do!

[UlisesGascon]

Also a code audit can be an option to explore, we did one in express time ago and went quite good (ref)

[ovflowd]

Right, I'm not sure what @evenstensberg is looking to get out from this, but I'm not sure the Sovereign Tech Resilience provides a long-term sort of funding or a one time-fee, it feels more like of a bug bounty program. Although the path of audits would be quite interesting.

But I don't think we should go through the audit path as we're very close from reworking on many pieces within Webpack's core.

[ovflowd]

I triple checked and I don't think there's anything that we can get out that program at the moment. I'd defer applying to the audit once we've worked on some of the modernizations of webpack core.

[evenstensberg]

@UlisesGascon Whos doing the audit? internal or external folks?

[UlisesGascon]

We did it with https://ostif.org/ (external) and funded by Sovereign Tech Agency

[evenstensberg]

That would work for us too, if STA funds us

[bjohansebas]

For posterity, @avivkeller sent an email to IBB to see if we can be accepted into IBB.