2025-03-17 Express Security Session

[github-actions]

Date/Time

Timezone	Date/Time
America/Los_Angeles	Mon 17-Mar-2025 09:30 (09:30 AM)
America/Denver	Mon 17-Mar-2025 10:30 (10:30 AM)
America/Chicago	Mon 17-Mar-2025 11:30 (11:30 AM)
America/New_York	Mon 17-Mar-2025 12:30 (12:30 PM)
Europe/London	Mon 17-Mar-2025 16:30 (04:30 PM)
Europe/Amsterdam	Mon 17-Mar-2025 17:30 (05:30 PM)
Europe/Moscow	Mon 17-Mar-2025 19:30 (07:30 PM)
Asia/Kolkata	Mon 17-Mar-2025 22:00 (10:00 PM)
Asia/Shanghai	Tue 18-Mar-2025 00:30 (12:30 AM)
Asia/Tokyo	Tue 18-Mar-2025 01:30 (01:30 AM)
Australia/Sydney	Tue 18-Mar-2025 03:30 (03:30 AM)

Or in your local time:

• https://www.timeanddate.com/worldclock/?iso=2025-03-17T16:30:00

Links

• Minutes Google Doc:

Agenda

Extracted from security-wg-agenda labelled issues and pull requests from expressjs/security-wg prior to the meeting.

• Time for a bounty program? discussions#345
• Process to handle security reports #56
• docs: clarify ownership and times for security reporting .github#15
• adjust the response time for vulnerability report #54
• Universal Action to rotate NPM keys #46
• Participation in the Security Program Standards #33
• Proposal: Move scorecards into a single repo #31
• Proposal: add repository security advisory #30
• Meeting next week? #28
• Socket.dev reports on all our repos #17
• Implementing OSSF Scorecard #2

Invited

• Security working team: @nodejs/security-wg

Observers/Guests

This meeting is open for anyone who wants to attend. Reminder to follow our Code of Conduct.

• @expressjs/security-wg
• @expressjs/security-triage

Joining the meeting

• link for participants: https://zoom-lfx.platform.linuxfoundation.org/meeting/93099394904?password=d712f2e5-4fc9-45d1-99c5-fd762b885588
• For those who just want to watch: https://www.youtube.com/@expressjs-official

---

Please use the following emoji reactions in this post to indicate your
availability.

• 👍 - Attending
• 👎 - Not attending
• 😕 - Not sure yet

[UlisesGascon]

I will love to include and prioritize (as I want to move ahead with them 😄):

• Time for a bounty program? discussions#345
• Process to handle security reports #56
• docs: clarify ownership and times for security reporting .github#15