This was extracted (@ 2026-09-18 21:10) from a list of minutes
which have been approved by the Board.
Please Note
The Board typically approves the minutes of the previous meeting at the
beginning of every Board meeting; therefore, the list below does not
normally contain details from the minutes of the most recent Board meeting.
ASF Members may have access to a
private draft
WARNING: these pages may omit some original contents of the minutes.
WHEREAS, the Board previously constituted the Apache Security Team as an Executive Committee of the Board with authority to act on behalf of the Foundation in matters of security; and WHEREAS, the Board has determined that these responsibilities are better vested in the office of Vice President, Security, an officer serving at the direction of and reporting to the Board of Directors, supported by a team to which that officer may delegate; and WHEREAS, the Board intends to grant that officer sufficient authority to act effectively while retaining for itself the oversight of the Foundation's security function; NOW, THEREFORE, BE IT RESOLVED, that the Apache Security Team is hereby dissolved as a committee of the Board; and be it further RESOLVED, that the Vice President, Security is responsible for organization and oversight of efforts to maintain the security of software produced by the Foundation's projects, and shall maintain oversight and tracking of security issues affecting those projects, consistent with the Foundation's security policy; and be it further RESOLVED, that in furtherance of that responsibility the Vice President, Security may take, and may direct Foundation resources to take, any and all steps reasonably necessary to that end; and be it further RESOLVED, that such steps include altering or removing project content, releases, or artifacts; issuing advisories on a project's behalf; disabling a site, service, or account; determining whether an issue is a security vulnerability; and communicating externally on security matters affecting the Foundation or any of its projects, including on a project's behalf; and be it further RESOLVED, that this authority is to be exercised in cooperation with the relevant project where practical, and to override it where necessary; and be it further RESOLVED, that the Vice President, Security may delegate work to a team whose members serve at that officer's discretion; and be it further RESOLVED, that all policies, procedures, and guidelines previously adopted by or under the authority of the Apache Security Team, including the vulnerability handling process and project security policy, remain in full force and effect as policies of the Vice President, Security until amended or revoked by that officer; and that the Foundation's role as a CVE Numbering Authority, all in-progress reports, all embargoes and confidentiality undertakings, and all associated infrastructure and communication channels are unaffected by this reconstitution and continue under the authority of the Vice President, Security; and be it further RESOLVED, that all prior actions of the Apache Security Team are ratified. Special Order 7F, Dissolve the Apache Security Team as a Board Committee, was approved by Unanimous Vote of the directors present.
