Project lead

In the context of the project security review and self-assessment, the “project lead” should be someone on the security team for the project. For new or smaller projects without an established security team, this could be a project maintainer or they may delegate to a regular contributor with an interest in security.

Time and effort

The level of effort for the team providing the information is expected to be around 80 hours of work. Note, projects that have already performed a security analysis internally are expected to have much lower requirements.

Conflict of interest

A project lead should not have any conflict of interest with the project.