WhoEmail-dateMember?

CommentCurrent Text

Suggested TextStatus(Accepted /Rejected /Modified /Duplicate)

Notes

Joubin Jabbari

6/25/2021 Yes

OWASP Projects should live within the OWASP GitHub page

RejectJoubin Jabbari

6/25/2021 Yes

OWASP Projects must identify as OWASP Project in their branding

AcceptJoubin Jabbari

6/25/2021 Yes

OWASP Projects should follow a licensing that would require for profit forks
to provide back to the project. I believe this would be AGPL.

RejectAndrew van derStock

7/26/2021 Yes

Permitted Open Source License"New projects must select an OSI-approved open source license. Existingprojects should relicense where possible to an OSI-approved license byDecember 31, 2021. In all cases, projects should provide a GitHub
LICENSE file. If in doubt, ask for a review of the existing license."

AcceptAndrew van derStock

7/26/2021 Yes

ModifiedRemove dates
to keep policy
evergreen

Andrew van derStock

7/26/2021 Yes

Contributor Agreement"New projects must use OWASP's standard contributor agreement](TBD) toensure that all contributions are the original work of the contributor and/or
they have permission to contribute that code or change. Existing projects
that do not have a contributor agreement should adopt OWASP's by
December 31, 2021. Existing projects with an existing contributor
agreement are exempt from this policy as long as the contributor
agreement doesn't conflict with OWASP's license requirements, copyrightassignment requirements, and covers the risks of plagiarised code. If indoubt, ask for a review of the existing agreement."
Copyright assignment

RejectLegal issues
should beconsidered andreviewed first especially as itpertains tocontributors

New projects must assign (C) to the OWASP Foundation. Existing projects,
where possible, should assign (C) to the OWASP Foundation by December
31, 2021.

Andrew van derStock

7/26/2021 Yes

Repositories"It is required for new
projects to use
OWASP’s official
project source platform.
Existing projects andnew projects requiring
an exception may
request one.""It is required for
Modified
new projects to use
OWASP’s official
project source
platform. Existing
projects should
migrate to theOWASP official
project source
platform byDecember 31, 2021.
If this is onerousupon existing
projects, they canask the Project
Committee or the
Executive Director
for an annual
exemption to thispolicy requirement."no consensus

Remove dates
to keep policy
evergreen.
Removal ofannual
exemption (onetime exemption
is sufficient)Who

Email-dateMember?

Comment

Current Text

Suggested Text

Status(Accepted /Rejected /Modified /Duplicate)Andrew van derStock

7/26/2021 Yes

Subdomains
All projects that need subdomains will be granted <subdomain>.owasp.org.
Existing domains that are not a sub-domain of owasp.org should redirect tothe official owasp.org subdomain. Expenses will not be paid for any otherdomain held by a project.

Modified

Andrew van derStock

7/26/2021 Yes

OWASP Branding on sub-domains
OWASP branding (including OWASP logo, links to the official owasp.org
website, project home page, and repo) should be prominent on subdomains or alternative domains maintained by the project. This branding
should adhere to the [OWASP Branding Guidelines](https://owasp.
org/www-policy/operational/branding.html).

Accept

Notes

Redirectionassuming
OWASP payingfor subdomain