Security Interest Group - Activity in 2026
No matches.
Past meetings
TR publications
-
4 documents published.
-
Threat Model for the Web published twice as a Draft Note. History of Threat Model for the Web
-
Threat Model for Decentralized Credentials published twice as a Draft Note. History of Threat Model for Decentralized Credentials
-
Past meetings
GitHub
w3c/securityig
-
1 issue opened.
-
Agenda: 2026-09-29 w3c/securityig#55, by @simoneonofri.
-
-
2 issues closed.
-
Agenda: 2026-09-29 w3c/securityig#55.
-
Agenda: 2026-09-15 w3c/securityig#54.
-
-
2 issues received 11 new comments.
w3c/threat-model-web
-
4 issues opened.
-
Missing process w3c/threat-model-web#25, by @bkardell.
-
The System Model w3c/threat-model-web#24, by @bkardell.
-
Are we dating this by saying "modern" w3c/threat-model-web#23, by @bkardell.
-
Application Capability Threat Model w3c/threat-model-web#22, by @csarven.
-
-
1 issue closed.
-
Application Capability Threat Model w3c/threat-model-web#22.
-
-
4 issues received 8 new comments.
-
1 pull request opened.
-
Clarify references to the threat models w3c/threat-model-web#26, by @simoneonofri.
-
-
2 pull requests merged.
-
Replace the High-Level Web Threat Model with the Generic Web API L0 w3c/threat-model-web#21.
-
Add identifiers and mark concepts w3c/threat-model-web#20.
-
-
1 pull request received 2 new comments.
-
Add identifiers and mark concepts w3c/threat-model-web#20 (2 comments by @BDADAD-stack, @elf-pavlik)
-
w3c/threat-modeling-guide
-
1 pull request opened.
-
Clarify the definition of threat and its distinction from threat source w3c/threat-modeling-guide#35, by @simoneonofri.
-
-
1 pull request received 1 new comment.
-
Clarify the definition of threat and its distinction from threat source w3c/threat-modeling-guide#35 (1 comment by @jandrieu)
-
w3c/threat-model-decentralized-credentials
-
2 pull requests opened.
-
Fix default code owners w3c/threat-model-decentralized-credentials#8, by @simoneonofri.
-
Trace harm pathways to their sources and refine workshop-derived scenarios w3c/threat-model-decentralized-credentials#7, by @simoneonofri.
-
-
2 pull requests merged.
-
Trace harm pathways to their sources and refine workshop-derived scenarios w3c/threat-model-decentralized-credentials#7.
-
Fix default code owners w3c/threat-model-decentralized-credentials#8.
-
-
1 pull request received 3 new comments.
-
Trace harm pathways to their sources and refine workshop-derived scenarios w3c/threat-model-decentralized-credentials#7 (3 comments by @Sh-Amir, @simoneonofri)
-
TR publications
-
1 document published.
Past meetings
Participants
-
1 participant joined.
-
Pavlik elf (W3C Invited Experts) joined.
-
GitHub
w3c/security-disclosure
-
2 pull requests opened.
-
Clarify post-verification coordination and reporter updates w3c/security-disclosure#16, by @simoneonofri.
-
Add CNA references and a public advisory index w3c/security-disclosure#15, by @simoneonofri.
-
w3c/threat-model-web
-
2 pull requests opened.
-
Replace the High-Level Web Threat Model with the Generic Web API L0 w3c/threat-model-web#21, by @simoneonofri.
-
Add identifiers and mark concepts w3c/threat-model-web#20, by @csarven.
-
-
1 pull request received 4 new comments.
-
Add identifiers and mark concepts w3c/threat-model-web#20 (4 comments by @csarven, @msporny, @simoneonofri)
-
w3c/threat-modeling-guide
-
1 pull request opened.
-
Add Threat Modeling FAQs w3c/threat-modeling-guide#34, by @simoneonofri.
-
-
1 pull request received 1 new comment.
-
Clarify how harms become concrete threat-model records w3c/threat-modeling-guide#31 (1 comment by @simoneonofri)
-
w3c/securityig
-
2 issues opened.
-
Agenda: 2026-09-15 w3c/securityig#54, by @simoneonofri.
-
Agenda: 2026-08-18 w3c/securityig#53, by @simoneonofri.
-
-
1 issue closed.
-
Agenda: 2026-08-18 w3c/securityig#53.
-
TR publications
-
1 document published.
-
Threat Model for the Web published as a Draft Note. History of Threat Model for the Web
-
Past meetings
-
1 meeting.
Participants
-
2 participants joined.
-
Thomas Jones (W3C Invited Experts) joined.
-
Gabriel Corona (W3C Invited Experts) joined.
-
-
5 participants left.
-
Alberto Fernandez-de-Retana (W3C Invited Experts) left.
-
Thomas Jones (W3C Invited Experts) left.
-
Greg Bernstein (W3C Invited Experts) left.
-
Sebastian Crane (W3C Invited Experts) left.
-
Xu Lin (W3C Invited Experts) left.
-
GitHub
w3c/security-disclosure
-
1 issue opened.
-
CVEs? w3c/security-disclosure#14, by @nicolo-ribaudo.
-
-
1 issue reopened.
-
SSRF in w3, w3c/security-disclosure#9, by @HackingRepo.
-
-
1 issue received 1 new comment.
w3c/securityig
-
2 issues opened.
-
Agenda: 2026-07-21 w3c/securityig#52, by @simoneonofri.
-
Agenda: 2026-07-07 w3c/securityig#51, by @simoneonofri.
-
-
3 issues closed.
-
Agenda: 2026-07-21 w3c/securityig#52.
-
Agenda: 2026-07-07 w3c/securityig#51.
-
Agenda: 2026-06-23 w3c/securityig#48.
-
-
1 issue received 2 new comments.
w3c/threat-model-web
-
1 pull request merged.
-
Mitre techniques w3c/threat-model-web#17.
-
w3c/security-questionnaire
-
1 issue opened.
-
Network Changes Question w3c/security-questionnaire#199, by @arichiv.
-
w3c/threat-modeling-guide
-
1 issue opened.
-
Clarify how to use the repo in an existing Spec w3c/threat-modeling-guide#33, by @jandrieu.
-
-
1 issue received 6 new comments.
-
Clarify relation to classes of products / conformance classes in the spec(s) w3c/threat-modeling-guide#32 (6 comments by @elf-pavlik, @jandrieu)
-
-
1 pull request received 1 new comment.
-
Clarify how harms become concrete threat-model records w3c/threat-modeling-guide#31 (1 comment by @jandrieu)
-
TR publications
-
8 documents published.
-
Threat Modeling Guide published 3 times as a Draft Note. History of Threat Modeling Guide
-
Threat Model for Decentralized Credentials published twice as a Draft Note. History of Threat Model for Decentralized Credentials
-
Threat Model for the Web published twice as a Draft Note. History of Threat Model for the Web
Past meetings
-
1 meeting.
Participants
-
1 participant joined.
-
Nishant Jain (W3C Invited Experts) joined.
-
-
1 participant left.
-
Nishant Jain (W3C Invited Experts) left.
-
GitHub
w3c/threat-modeling-guide
-
1 issue opened.
-
Clarify relation to classes of products / conformance classes in the spec(s) w3c/threat-modeling-guide#32, by @elf-pavlik.
-
-
3 issues closed.
-
Add the Mitigating Browser Fingerprinting in Web Specifications as an example of list w3c/threat-modeling-guide#15.
-
Consider defining "harm" and "vulnerability" in this context w3c/threat-modeling-guide#21.
-
Four types of threats repeated twice in sections 2 & 3 w3c/threat-modeling-guide#18.
-
-
5 issues received 5 new comments.
-
Threat model example: explain how threats got identified w3c/threat-modeling-guide#12 (1 comment by @simoneonofri)
-
Add the Mitigating Browser Fingerprinting in Web Specifications as an example of list w3c/threat-modeling-guide#15 (1 comment by @simoneonofri)
-
Consider defining "harm" and "vulnerability" in this context w3c/threat-modeling-guide#21 (1 comment by @simoneonofri)
-
Dark mode - threat boxes have low contrast between bg and font w3c/threat-modeling-guide#20 (1 comment by @elf-pavlik)
-
Four types of threats repeated twice in sections 2 & 3 w3c/threat-modeling-guide#18 (1 comment by @elf-pavlik)
-
-
7 pull requests opened.
-
Clarify how harms become concrete threat-model records w3c/threat-modeling-guide#31, by @simoneonofri.
-
Clarify harm and adverse impact terminology w3c/threat-modeling-guide#30, by @simoneonofri.
-
Update abstract to clarify threat modeling scope and outputs w3c/threat-modeling-guide#29, by @simoneonofri.
-
Update introduction guidance for threat modeling w3c/threat-modeling-guide#28, by @simoneonofri.
-
Clarify the purpose of threat modeling for specification developers w3c/threat-modeling-guide#27, by @simoneonofri.
-
Update terminology with Bikeshed definitions and source alignment w3c/threat-modeling-guide#26, by @simoneonofri.
-
Clarify the purpose of threat modeling for specification developers w3c/threat-modeling-guide#25, by @simoneonofri.
-
-
6 pull requests merged.
-
Update abstract to clarify threat modeling scope and outputs w3c/threat-modeling-guide#29.
-
Update introduction guidance for threat modeling w3c/threat-modeling-guide#28.
-
typo s/nince/nine/ w3c/threat-modeling-guide#19.
-
Removing the repetition of the type of threats w3c/threat-modeling-guide#23.
-
Adding terminology (bug, exploit, security, vulnerability, harms) w3c/threat-modeling-guide#22.
-
Update terminology with Bikeshed definitions and source alignment w3c/threat-modeling-guide#26.
-
-
2 pull requests closed.
-
Clarify the purpose of threat modeling for specification developers w3c/threat-modeling-guide#27.
-
Clarify the purpose of threat modeling for specification developers w3c/threat-modeling-guide#25.
-
-
3 pull requests received 38 new comments.
-
Update introduction guidance for threat modeling w3c/threat-modeling-guide#28 (31 comments by @ianbjacobs, @jandrieu, @simoneonofri)
-
Clarify harm and adverse impact terminology w3c/threat-modeling-guide#30 (5 comments by @elf-pavlik, @simoneonofri)
-
Clarify the purpose of threat modeling for specification developers w3c/threat-modeling-guide#25 (2 comments by @ianbjacobs, @simoneonofri)
-
w3c/security-disclosure
-
1 pull request opened.
-
Update vulnerability disclosure policy text w3c/security-disclosure#13, by @simoneonofri.
-
-
3 pull requests merged.
-
Update vulnerability disclosure policy text w3c/security-disclosure#13.
-
Clarify? wording w3c/security-disclosure#10.
-
link Github security functionality w3c/security-disclosure#11.
-
w3c/threat-model-decentralized-credentials
-
1 pull request opened.
-
Rewrite credential threat model structure and DFD traceability w3c/threat-model-decentralized-credentials#6, by @simoneonofri.
-
-
1 pull request merged.
-
Rewrite credential threat model structure and DFD traceability w3c/threat-model-decentralized-credentials#6.
-
-
1 pull request received 22 new comments.
-
Rewrite credential threat model structure and DFD traceability w3c/threat-model-decentralized-credentials#6 (22 comments by @Sh-Amir, @simoneonofri, @ZAnsaroudi)
-
w3c/securityig
-
3 issues opened.
-
TPAC 2026 meeting slot w3c/securityig#50, by @simoneonofri.
-
Agenda: TPAC 2026 @ Dublin (F2F) w3c/securityig#49, by @simoneonofri.
-
Agenda: 2026-06-23 w3c/securityig#48, by @simoneonofri.
-
-
3 issues closed.
-
TPAC 2026 meeting slot w3c/securityig#50.
-
Agenda 2026-06-09 w3c/securityig#47.
-
-
2 issues received 4 new comments.
w3c/threat-model-web
-
2 issues closed.
-
section 1.1 usage scenario w3c/threat-model-web#11.
-
Active/passive content distinction? w3c/threat-model-web#10.
-
-
2 pull requests opened.
-
High-Level Threat Model, as the first one w3c/threat-model-web#19, by @simoneonofri.
-
Clarify active and passive web content w3c/threat-model-web#18, by @simoneonofri.
-
-
4 pull requests merged.
-
High-Level Threat Model, as the first one w3c/threat-model-web#19.
-
Added web browser layer w3c/threat-model-web#9.
-
Clarify websites as active execution environments w3c/threat-model-web#16.
-
Clarify active and passive web content w3c/threat-model-web#18.
-
-
1 pull request closed.
-
Web browser layer w3c/threat-model-web#14.
-
-
3 pull requests received 5 new comments.
-
High-Level Threat Model, as the first one w3c/threat-model-web#19 (3 comments by @BDADAD-stack, @simoneonofri)
-
w3c/security-guidelines-cryptography
-
1 pull request opened.
-
Editorial: fix typos in 7.1. Symmetric encryption w3c/security-guidelines-cryptography#21, by @Dahkenangnon.
-
TR publications
-
4 documents published.
-
Threat Model for Decentralized Credentials published as a Draft Note. History of Threat Model for Decentralized Credentials
-
Threat Model for the Web published as a Draft Note. History of Threat Model for the Web
-
Threat Modeling Guide published twice as a Draft Note. History of Threat Modeling Guide
-
Past meetings
Participants
-
1 participant joined.
-
Chaals Nevile (W3C Invited Experts) joined.
-
GitHub
w3c/threat-model-decentralized-credentials
-
1 pull request merged.
-
fix: update the link in readme file w3c/threat-model-decentralized-credentials#5.
-
w3c/threat-model-web
-
4 issues opened.
-
possible extension to hardware protections both on device on on inserted cards - from AI w3c/threat-model-web#13, by @TomCJones.
-
1.3. External Dependencies need h/w support w3c/threat-model-web#12, by @TomCJones.
-
section 1.1 usage scenario w3c/threat-model-web#11, by @TomCJones.
-
Active/passive content distinction? w3c/threat-model-web#10, by @Frosne.
-
-
2 issues closed.
-
New DFD 0.9.1 w3c/threat-model-web#7.
-
New DFD 0.9 w3c/threat-model-web#6.
-
-
6 issues received 7 new comments.
-
possible extension to hardware protections both on device on on inserted cards - from AI w3c/threat-model-web#13 (1 comment by @simoneonofri)
-
5 pull requests opened.
-
Mitre techniques w3c/threat-model-web#17, by @BDADAD-stack.
-
Clarify websites as active execution environments w3c/threat-model-web#16, by @simoneonofri.
-
Aligning main with FND w3c/threat-model-web#15, by @simoneonofri.
-
Web browser layer w3c/threat-model-web#14, by @BDADAD-stack.
-
Added web browser layer w3c/threat-model-web#9, by @BDADAD-stack.
-
-
1 pull request closed.
-
Aligning main with FND w3c/threat-model-web#15.
-
-
1 pull request received 7 new comments.
-
Added web browser layer w3c/threat-model-web#9 (7 comments by @BDADAD-stack, @Frosne, @simoneonofri)
-
w3c/securityig
-
2 issues opened.
-
Agenda 2026-06-09 w3c/securityig#47, by @simoneonofri.
-
Agenda: 2026-05-26 w3c/securityig#46, by @simoneonofri.
-
-
1 issue closed.
-
Agenda: 2026-05-26 w3c/securityig#46.
-
-
2 issues received 4 new comments.
w3c/threat-modeling-guide
-
1 issue closed.
-
re-word "accessible" not related to people with disabilities w3c/threat-modeling-guide#16.
-
-
1 issue received 1 new comment.
-
re-word "accessible" not related to people with disabilities w3c/threat-modeling-guide#16 (1 comment by @simoneonofri)
-
-
1 pull request merged.
-
s/accessible/available/ w3c/threat-modeling-guide#24.
-
-
1 pull request received 1 new comment.
w3c/security-disclosure
-
1 issue opened.
-
where can one find the public key for standards-vulnerability@w3.org? w3c/security-disclosure#12, by @pchampin.
-
-
1 issue received 1 new comment.
-
Proposal to hit 'reset' button on 'Security Disclosure' Process w3c/security-disclosure#3 (1 comment by @chaals)
-
-
2 pull requests opened.
-
link Github security functionality w3c/security-disclosure#11, by @chaals.
-
Clarify? wording w3c/security-disclosure#10, by @chaals.
-
Past meetings
Participants
-
1 participant left.
-
Kester Quist-Aphetsi (CRITAC) left.
-
-
1 organization left.
-
CRITAC left.
-
GitHub
w3c/securityig
-
1 pull request opened.
-
added agenda item w3c/securityig#45, by @BDADAD-stack.
-
-
1 pull request merged.
-
added agenda item w3c/securityig#45.
-
w3c/security-guidelines-cryptography
-
1 issue opened.
-
a few suggestions from TAG w3c/security-guidelines-cryptography#20, by @toreini.
-
w3c/threat-model-web
-
2 issues opened.
-
New DFD 0.9.1 w3c/threat-model-web#7, by @BDADAD-stack.
-
New DFD 0.9 w3c/threat-model-web#6, by @BDADAD-stack.
-
-
1 pull request opened.
-
Updated DFD w3c/threat-model-web#8, by @BDADAD-stack.
-
-
1 pull request merged.
-
Updated DFD w3c/threat-model-web#8.
-
w3c/threat-modeling-guide
-
1 issue opened.
-
Consider defining "harm" and "vulnerability" in this context w3c/threat-modeling-guide#21, by @anssiko.
-
-
1 issue closed.
-
Specify relationship between responses, mitigations and related terminology w3c/threat-modeling-guide#13.
-
-
2 issues received 2 new comments.
-
Specify relationship between responses, mitigations and related terminology w3c/threat-modeling-guide#13 (1 comment by @simoneonofri)
-
Threat model example: explain how threats got identified w3c/threat-modeling-guide#12 (1 comment by @anssiko)
-
-
3 pull requests opened.
-
s/accessible/available/ w3c/threat-modeling-guide#24, by @simoneonofri.
-
Removing the repetition of the type of threats w3c/threat-modeling-guide#23, by @simoneonofri.
-
Adding terminology (bug, exploit, security, vulnerability, harms) w3c/threat-modeling-guide#22, by @simoneonofri.
-
w3c/threat-model-decentralized-credentials
-
2 pull requests opened.
-
fix: update the link in readme file w3c/threat-model-decentralized-credentials#5, by @Sh-Amir.
-
Updates: Sociotechnical aspects w3c/threat-model-decentralized-credentials#4, by @simoneonofri.
-
-
1 pull request merged.
-
Updates: Sociotechnical aspects w3c/threat-model-decentralized-credentials#4.
-
-
1 pull request received 8 new comments.
-
Updates: Sociotechnical aspects w3c/threat-model-decentralized-credentials#4 (8 comments by @Sh-Amir)
-
Past meetings
Participants
-
5 participants joined.
-
Amir Sharif (Fondazione Bruno Kessler) joined.
-
Giovanni Corti (Fondazione Bruno Kessler) joined.
-
Zahra Ebadi Ansaroudi (Fondazione Bruno Kessler) joined.
-
Brandon Walderman (Microsoft Corporation) joined.
-
Michael Jackson (Microsoft Corporation) joined.
-
-
3 participants left.
-
Giovanni Corti (Fondazione Bruno Kessler) left.
-
Zahra Ebadi Ansaroudi (Fondazione Bruno Kessler) left.
-
Amir Sharif (Fondazione Bruno Kessler) left.
-
-
2 organizations joined.
-
Fondazione Bruno Kessler joined.
-
Microsoft Corporation joined.
-
GitHub
w3c/threat-modeling-guide
-
3 issues opened.
-
Dark mode - threat boxes have low contrast between bg and font w3c/threat-modeling-guide#20, by @elf-pavlik.
-
Four types of threats repeated twice in sections 2 & 3 w3c/threat-modeling-guide#18, by @elf-pavlik.
-
Add a section on the Use of AI w3c/threat-modeling-guide#17, by @jandrieu.
-
-
1 issue received 6 new comments.
-
Add a section on the Use of AI w3c/threat-modeling-guide#17 (6 comments by @jandrieu, @realArcherL, @simoneonofri)
-
-
1 pull request opened.
-
typo s/nince/nine/ w3c/threat-modeling-guide#19, by @elf-pavlik.
-
w3c/securityig
-
2 issues opened.
-
Agenda: 2026-03-31 w3c/securityig#44, by @simoneonofri.
-
Agenda: 2026-03-17 w3c/securityig#43, by @simoneonofri.
-
-
3 issues closed.
-
Agenda: 2026-03-31 w3c/securityig#44.
-
Agenda: 2026-03-17 w3c/securityig#43.
-
Agenda: 2026-03-03 w3c/securityig#42.
-
-
3 issues received 6 new comments.
-
Security and Privacy Challenges in the Future Forms, Identity Binding, and Authentication Mechanisms of AI Agents w3c/securityig#27 (2 comments by @internet-dot, @TomCJones)
w3c/security-questionnaire
-
1 issue opened.
-
Add issue regarding "dumb pipe" APIs w3c/security-questionnaire#198, by @pes10k.
-
-
1 issue received 3 new comments.
-
Add issue regarding "dumb pipe" APIs w3c/security-questionnaire#198 (3 comments by @marcoscaceres, @simoneonofri)
-
w3c/threat-model-web
-
2 issues opened.
-
Integrate Threats from S&P Questionnaire w3c/threat-model-web#5, by @simoneonofri.
-
Add new Diagram Model > Standards > Implementations > Browsers w3c/threat-model-web#4, by @simoneonofri.
-
-
1 pull request opened.
-
Minor editorial nits w3c/threat-model-web#3, by @bkardell.
-
-
1 pull request merged.
-
Minor editorial nits w3c/threat-model-web#3.
-
TR publications
-
1 document published.
-
Threat Modeling Guide published as a Draft Note. History of Threat Modeling Guide
-
Past meetings
Participants
-
6 participants joined.
-
Nathan Parker (Google LLC) joined.
-
Luca Lumini (W3C Invited Experts) joined.
-
Julia Pagnucco (Google LLC) joined.
-
Harsh Singhal (Amazon) joined.
-
Will Abramson (Legendary Requirements) joined.
-
Rob Padula (Legendary Requirements) joined.
-
GitHub
w3c/threat-modeling-guide
-
1 issue opened.
-
re-word "accessible" not related to people with disabilities w3c/threat-modeling-guide#16, by @shawna-slh.
-
-
4 issues closed.
-
Appendix 1: The B1 component does not exist w3c/threat-modeling-guide#7.
-
Suggestion: Add non-normative example structure for threat listing in Section 5.3 w3c/threat-modeling-guide#2.
-
Suggestion: Add example stakeholder inventory example to Section 5.2 (Identify the Stakeholders) w3c/threat-modeling-guide#1.
-
improve table formating of threat details w3c/threat-modeling-guide#5.
-
-
7 issues received 14 new comments.
-
Is response R6 in scope of the example? w3c/threat-modeling-guide#9 (4 comments by @jandrieu, @simoneonofri, @tidoust)
-
re-word "accessible" not related to people with disabilities w3c/threat-modeling-guide#16 (2 comments by @jandrieu, @simoneonofri)
-
Suggestion: Add non-normative example structure for threat listing in Section 5.3 w3c/threat-modeling-guide#2 (2 comments by @jandrieu, @realArcherL)
-
Suggestion: Add example stakeholder inventory example to Section 5.2 (Identify the Stakeholders) w3c/threat-modeling-guide#1 (2 comments by @jandrieu, @realArcherL)
-
Add How To Write Security Considerations section w3c/threat-modeling-guide#3 (2 comments by @jandrieu, @simoneonofri)
-
-
1 pull request merged.
-
Continuing revision (2nd Draft) w3c/threat-modeling-guide#14.
-
-
1 pull request closed.
-
Editorial changes to lists and example threat tables w3c/threat-modeling-guide#6.
-
-
1 pull request received 2 new comments.
-
Editorial changes to lists and example threat tables w3c/threat-modeling-guide#6 (2 comments by @jandrieu, @tidoust)
-
w3c/securityig
-
2 issues opened.
-
Agenda: 2026-03-03 w3c/securityig#42, by @simoneonofri.
-
Agenda: 2026-02-17 w3c/securityig#41, by @simoneonofri.
-
-
2 issues closed.
-
Agenda: 2026-02-17 w3c/securityig#41.
-
Agenda: 2026-02-03 w3c/securityig#40.
-
-
2 issues received 4 new comments.
-
CfC to publish Cryptography usage in Web Standards as a First Public Interest Group Note < 2025-11-05 w3c/securityig#33 (1 comment by @simoneonofri)
w3c/security-disclosure
-
1 issue opened.
-
SSRF in w3, w3c/security-disclosure#9, by @HackingRepo.
-
w3c/security-guidelines-cryptography
-
1 issue opened.
-
Security services #3 w3c/security-guidelines-cryptography#19, by @cristianlepore.
-
-
4 issues received 5 new comments.
-
Crypto Agility References w3c/security-guidelines-cryptography#8 (2 comments by @cristianlepore, @Frosne)
-
John Preuß Mattsson review of the document w3c/security-guidelines-cryptography#15 (1 comment by @cristianlepore)
-
Key derivation function might benefit from talking about parameters (like, number of iterations) w3c/security-guidelines-cryptography#6 (1 comment by @cristianlepore)
-
Cryptographic keys section does not distinguish asymetric private/public and symmetric keys. w3c/security-guidelines-cryptography#4 (1 comment by @cristianlepore)
-
TR publications
-
3 documents published.
-
Cryptography usage in Web Standards published as a Draft Note. History of Cryptography usage in Web Standards
-
Threat Model for Decentralized Credentials published as a Draft Note. History of Threat Model for Decentralized Credentials
-
Threat Modeling Guide published as a Draft Note. History of Threat Modeling Guide
-
Past meetings
GitHub
w3c/threat-modeling-guide
-
12 issues opened.
-
Add the Mitigating Browser Fingerprinting in Web Specifications as an example of list w3c/threat-modeling-guide#15, by @simoneonofri.
-
Specify relationship between responses, mitigations and related terminology w3c/threat-modeling-guide#13, by @simoneonofri.
-
Threat model example: explain how threats got identified w3c/threat-modeling-guide#12, by @tidoust.
-
Threat actor and adversary w3c/threat-modeling-guide#10, by @tidoust.
-
Is response R6 in scope of the example? w3c/threat-modeling-guide#9, by @tidoust.
-
Some images in the visual language seem off w3c/threat-modeling-guide#8, by @tidoust.
-
Appendix 1: The B1 component does not exist w3c/threat-modeling-guide#7, by @tidoust.
-
improve table formating of threat details w3c/threat-modeling-guide#5, by @jandrieu.
-
Fix images for maintenance and accessibility w3c/threat-modeling-guide#4, by @jandrieu.
-
Add How To Write Security Considerations section w3c/threat-modeling-guide#3, by @jandrieu.
-
Suggestion: Add non-normative example structure for threat listing in Section 5.3 w3c/threat-modeling-guide#2, by @realArcherL.
-
Suggestion: Add example stakeholder inventory example to Section 5.2 (Identify the Stakeholders) w3c/threat-modeling-guide#1, by @realArcherL.
-
-
2 issues closed.
-
Threat actor and adversary w3c/threat-modeling-guide#10.
-
Some images in the visual language seem off w3c/threat-modeling-guide#8.
-
-
4 issues received 6 new comments.
-
Threat model example: explain how threats got identified w3c/threat-modeling-guide#12 (3 comments by @simoneonofri, @tidoust)
-
Suggestion: Add non-normative example structure for threat listing in Section 5.3 w3c/threat-modeling-guide#2 (1 comment by @realArcherL)
-
Suggestion: Add example stakeholder inventory example to Section 5.2 (Identify the Stakeholders) w3c/threat-modeling-guide#1 (1 comment by @realArcherL)
-
-
3 pull requests opened.
-
Continuing revision (2nd Draft) w3c/threat-modeling-guide#14, by @jandrieu.
-
Terminology: Threat Actors and Adversaries w3c/threat-modeling-guide#11, by @simoneonofri.
-
Editorial changes to lists and example threat tables w3c/threat-modeling-guide#6, by @tidoust.
-
-
1 pull request merged.
-
Terminology: Threat Actors and Adversaries w3c/threat-modeling-guide#11.
-
-
3 pull requests received 7 new comments.
-
Editorial changes to lists and example threat tables w3c/threat-modeling-guide#6 (3 comments by @jandrieu, @simoneonofri, @tidoust)
-
Terminology: Threat Actors and Adversaries w3c/threat-modeling-guide#11 (1 comment by @simoneonofri)
w3c/securityig
-
4 issues opened.
-
Agenda: 2026-02-03 w3c/securityig#40, by @simoneonofri.
-
Work Item: W3C Standards Vulnerability Disclosure & Handling Process and Policy w3c/securityig#39, by @simoneonofri.
-
Agenda: 2026-01-20 w3c/securityig#37, by @simoneonofri.
-
-
4 issues closed.
-
Agenda: 2026-01-20 w3c/securityig#37.
-
Agenda: 2026-01-06 w3c/securityig#36.
-
8 issues received 19 new comments.
-
CfC to publish Threat Modeling Guide as a First Public Draft Interest Group Note < 2026-01-14 w3c/securityig#38 (2 comments by @simoneonofri)
-
CfC to publish Cryptography usage in Web Standards as a First Public Interest Group Note < 2025-11-05 w3c/securityig#33 (2 comments by @simoneonofri)
-
CfC: Adopt W3C Standards Vulnerability Disclosure & Handling Process and Policy as a Work Item w3c/securityig#13 (1 comment by @simoneonofri)
w3c/threat-model-decentralized-credentials
-
1 issue closed.
-
Update links in repo to the document w3c/threat-model-decentralized-credentials#3.
-
-
1 issue received 1 new comment.
-
Update links in repo to the document w3c/threat-model-decentralized-credentials#3 (1 comment by @simoneonofri)
-