Skip to content

data-management.md

Latest commit

 

History

History
64 lines (44 loc) · 4.03 KB

data-management.md

File metadata and controls

64 lines (44 loc) · 4.03 KB
Raw

Types of Data Collected {-}

This project will primarily collect and generate the following types of data:

  1. Security vulnerability reports and assessments within the Scientific Python Open Source Ecosystem ($\spose$).
  2. Community feedback on proposed security standards and best practices.
  3. Technical documentation for security mechanisms and protocols.
  4. Usage statistics and metrics related to the adoption of security measures.
  5. Anonymized data on security incidents and their resolutions.
  6. Educational materials on open-source security practices.

Data Collection and Storage {-}

All data will be collected through secure channels, ensuring the privacy and confidentiality of contributors. Sensitive information, such as unreleased vulnerability reports, will be encrypted and stored in secure repositories with restricted access. Non-sensitive data will be stored in public repositories on platforms like GitHub, following best practices for open-source project management.

Data Sharing and Access {-}

We are committed to open science and will make all non-sensitive data publicly available. This includes:

  • Technical documentation and educational materials, which will be published on the project website and GitHub repositories.
  • Anonymized and aggregated security metrics, which will be shared through regular public reports.
  • Community feedback and discussions, which will be archived in public forums or mailing lists.

Access to sensitive data, such as ongoing vulnerability investigations, will be strictly controlled. Only authorized team members and relevant stakeholders will have access to this information, governed by clear access policies and secure authentication mechanisms.

Protection of Sensitive Data {-}

To protect sensitive data:

  • We will implement end-to-end encryption for all communications regarding unreleased vulnerabilities.
  • Access to sensitive repositories will require multi-factor authentication.
  • We will use anonymization techniques to remove identifiable information from security incident reports before public release.

Data Retention and Archiving {-}

Non-sensitive project data will be retained indefinitely on public platforms to ensure long-term accessibility for the community. Sensitive data related to resolved security issues will be securely archived for a period of five years, after which it will be thoroughly reviewed for potential public release or secure deletion.

Licensing and Attribution {-}

All public data, documentation, and educational materials produced by this project will be released under the Creative Commons Attribution 4.0 International License (CC BY 4.0). This license allows for maximum reuse and adaptation while ensuring proper attribution. Any code produced as part of the project will be released under the BSD 3-Clause License, consistent with many Scientific Python projects.

Ethical Considerations and IRB Approval {-}

While we do not anticipate collecting personal data that would require IRB approval, we will continuously assess our data collection practices. If any activities arise that involve human subjects research, we will seek IRB approval before proceeding. We are committed to ethical data practices and will prioritize the privacy and security of all participants and contributors.

Community Engagement and Data Management {-}

We will actively engage with the Scientific Python community to ensure our data management practices align with community expectations and needs. Regular updates on our data management practices will be provided through the Scientific Python Ecosystem Coordination ($\spec$) process. We will establish a clear process for community members to request access to or correction of any data related to them.

By implementing this comprehensive Data Management and Sharing Plan, we aim to balance open science principles with the need for security and privacy in the context of our project to secure the Scientific Python Open Source Ecosystem.