security-reviews
security-reviews copied to clipboard
Tabletop Exercise
We should conduct a tabletop exercise for different review scenarios, including:
- Normal Review -> Someone submits a review PR, which gets reviewed, and then merged.
- Disputed Review -> Someone flags a review as inappropriate. "We" agree, and change the review accordingly.
- Two-Sided Dispute -> There's genuine good-faith difference of opinion in an important part of a review.
- Bias Accusation -> Someone accuses the project maintainers of bias because X was merged but Y was not.
- Accidental Merge -> We accidentally merge something that shouldn't have been.
- Accidental Merge / Chaos -> We accidentally merge something that really, really, really shouldn't have been.
- New Maintainer -> Someone wants to join the project and review PRs as they come in.
- Don't Link to Me -> Someone includes a link to a 3rd party review, that 3rd party takes issue with the linking and asks us to take it down.
I'm sure there are more scenarios.