CPAN Security Group

Welcome to the CPAN Security Group. This is a community effort for supporting and responding to security incidents on CPAN – the Comprehensive Perl Archive Network.

This group also cares about security-related topics around CPAN distributions, the CPAN/PAUSE infrastructure, and about tooling and the ecosystem in general. Over time, we aim to improve supply chain security, make CPAN a more secure and trustworthy publishing platform, and more.

CPANSec is the CVE Numbering Authority (CNA) for CPAN and Perl.

Learn more & Contribute

On CPAN, improving security is a volunteer-driven collaborative effort. If you care and would like to make a contribution, you can…

• Explore our main website
• Check us out on Github
• Join us in our Matrix channel, #cpansec-discussion on matrix.org
• Join us in our IRC channel, #cpan-security on irc.perl.org
• Send an e-mail to the CPAN Security Group <cpan-security@security.metacpan.org> 📧
• Subscribe to @cpansec@fosstodon.org on the Fediverse 🐘
• Subscribe to the CPANSec mailing lists
• Browse and read the CPANSec CVE Announcements archive

Resources

• Security and incident policies
  • How to Report a Security Issue
  • The CPANSec CNA Disclosure Policy
  • The CPANSec Contributor Pre-Release Disclosure Agreement
• Important Documents and other relevant resources
  • Group charter ⚠️ DRAFT
  • Standards and regulations reading list ⚠️ DRAFT
  • Guides
  • Consultations
• Projects overview on Github
• Meetings information and minutes
• Presentations about us and our work

Recent news

Recent blog posts