# Open Source Governance

> Open source policy, license compliance, contribution guidelines, dependency management, and supply chain security

- Skill: `hack23/open-source-governance-3` (Agent Skill)
- Install (CLI): `npx skillmds@latest add hack23/open-source-governance-3`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hack23/open-source-governance-3/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: Hack23 (https://skillmd.com/u/hack23)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/hack23/open-source-governance-3

---


# Open Source Governance Skill


## 🔴 AI FIRST Quality Principle

> **Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.**

## Purpose
Defines governance for open source software use, contribution, and publication ensuring license compliance and supply chain security.

## License Compliance
### Approved Licenses
- MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause
- ISC, CC-BY-4.0, Unlicense, 0BSD

### Restricted Licenses (Require Review)
- GPL-2.0, GPL-3.0, LGPL, AGPL
- SSPL, BSL, Commons Clause

### Prohibited
- No license specified (proprietary by default)
- Licenses incompatible with project license

## Dependency Management
- Pin dependencies to specific versions
- Use lock files (package-lock.json)
- Regular dependency updates via Dependabot
- Security scanning for known vulnerabilities
- SBOM generation for supply chain transparency

## Contribution Guidelines
- CONTRIBUTING.md required in all repos
- Code of Conduct (Contributor Covenant)
- Developer Certificate of Origin (DCO)
- PR review requirements
- CLA not required for Hack23 projects

## Supply Chain Security
- Pin GitHub Actions to SHA (not tags)
- Use step-security/harden-runner
- Enable Dependabot security updates
- Secret scanning with push protection
- SLSA provenance for releases

## ISO 27001:2022 Mapping
- **A.5.5** — Contact with authorities (CVE, disclosure)
- **A.5.19–A.5.21** — Supplier/ICT supply-chain security (SBOM, approved licences)
- **A.5.23** — Information security for use of cloud services (GitHub, hosted services)
- **A.8.8** — Management of technical vulnerabilities (Dependabot, CodeQL)
- **A.8.25** — Secure development lifecycle
- **A.8.28** — Secure coding
- **A.8.30** — Outsourced development (OSS maintainers, third-party libraries)

## NIST CSF 2.0 Mapping
- **GV.SC** — Cybersecurity Supply Chain Risk Management
- **ID.SC** — Supply chain inventory (SBOM, licence inventory)
- **PR.IP-12** — Vulnerability management plan
- **PR.DS-6** — Integrity checking (signed commits, SLSA attestations)

## CIS Controls v8.1 Mapping
- **2.1–2.7** — Inventory and control of software assets
- **3.4** — Encrypt data on end-user devices
- **7.5–7.7** — Continuous vulnerability management
- **16.4** — Establish and manage authoritative software libraries
- **16.11** — Leverage vetted modules or services for software components

## Related Hack23 ISMS Policies
- [Information_Security_Policy.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Information_Security_Policy.md) — governance umbrella
- [Secure_Development_Policy.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Secure_Development_Policy.md) — SDLC security requirements
- [Open_Source_Policy.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Open_Source_Policy.md) — approved/restricted/prohibited licences, contribution rules
- [Vulnerability_Management.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Vulnerability_Management.md) — remediation SLAs (Crit 24h / High 7d / Med 30d / Low 90d)
- [Change_Management.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Change_Management.md) — dependency-update approval flows
- [AI_Policy.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/AI_Policy.md) — AI-assisted contributions require human review
- [Incident_Response_Plan.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Incident_Response_Plan.md) — OSS CVE / supply-chain incident handling