10. Getting help

You are here if: you are stuck and need a human.

You do not have to figure this out alone. Where to turn:

• Your ecosystem's foundation. If your project sits under a foundation, it likely has a security team or its own CNA that can help with process and CVE assignment. Contacts vary by ecosystem:
  • JavaScript / Node.js (the OpenJS Foundation):
    • OpenJS CNA for CVE assignment.
    • OpenJS Security Working Group to get involved or ask.
  • More ecosystems welcome via contributions.
• GitHub. For projects outside a foundation, GitHub Staff handle advisory and CVE edge cases, and the official docs cover the mechanics.
• The CVE program. For identifier questions, the CVE program publishes a FAQ and the CNA Rules.
• OpenSSF. The Open Source Security Foundation runs working groups, guides, and tooling for exactly this kind of work, and it is a good place to find people who have handled it before.
• Other maintainers. Peers solving the same problem you are have likely hit your issue before (see §9 on building that network). You are already the effective leader of your project; usually you just need a second opinion to make a confident call.
• This guide. Its authors and contributors are happy to help, open an issue or see CONTRIBUTING.