Arnout Engelen

Lifecycle of discovered endpoints

2

When discovering endpoints via Akka Discovery, it is now unclear how long those results are valid. Users can either re-run discovery for each new connection, or keep using the once-discovered...

Autodetect version tags

2

Towards #2139

auto-detect tags for `version_tags`

2

Finding (recent?) tags in the VCS of the form 'x.y.z' or 'vx.y.z' should probably be sufficient to assume this criterion is met

There are some others but it's not obvious whether they should change, or what to.

The description for `vulnerability_report_private` on https://www.bestpractices.dev is currently: > If private vulnerability reports are supported, the project MUST include how to send the information in a way that is kept...

auto-detect .github/SECURITY.md for `vulnerability_report_process`

2

if a repository-level or org-level (e.g. https://github.com/apache/.github/blob/main/.github/SECURITY.md) `.github/SECURITY.md` is found that should be sufficient to auto-detect `vulnerability_report_process`

If the project is using GitHub and has GitHub Issues enabled, that might be sufficient to auto-detect `report_process`, `report_tracker` and `report_archive`

When creating a new alarm, you must have first selected a station, otherwise no alarm is added. It might be nice to show a message explaining what's going on.

(draft for now because still untested)