A Project Maintainers Guide To TAG Security
Talkat CNCF Maintainer Summit Europe 2025 · on Monday, 2025-03-31· at 11:35· Level 3 | ICC Capital Suite 14-16·
summary
TAG Security runs metric-driven activities: a Security Slam with five badges and curated issues, and project self-assessments plus optional joint assessments with TAG reviewers. OpenFGA uses the process, is listed with ~35 public adopters, got all five badges, and records an OpenSSF Scorecard 9.3. Work includes adding SBOMs, improving CI/testing to cover authorization combos, moving the self-assessment into the TAG repo, and a disclosed case where an experimental flag returned wrong value and TAG advised against filing a CVE.
AI-written summary · about
chapters (10)
- 0:00TAG Security and OpenFGA intro
- 1:07TAG Security mission
- 1:50OpenFGA authorization overview
- 3:34OpenFGA incubation levels
- 6:46Security Slam initiative
- 10:39Project security assessments
- 15:20TAG Security demos
- 17:04TAG Security resources
- 18:49Engaging with TAG Security
- 19:32Q&A
related talks
07mA Security Engineer’s Guide to TAG Security
05mA Maintainer’s Tour Of Tag Security And Compliance
30mThe Immediate and Lasting Benefits of TAG Security Assessments
36mLevel up Your Security Career with the TAG Security Community
24mStaring Into the Abyss With the Security Technical Advisory Group
16mSecurity TAG Closing
32mStaring Into the Abyss with the Security Technical Advisory Group
17mKeynote: TAG Security, You're It!