April 2026 Minutes

Motion "Resolved, the Executive Director is permitted to contract with Harold Blankenship at market rates as determined by similar roles advertised on Upwork.

To address perceived or actual conflicts of interest, based upon legal advice, the following guardrails will be in place:

• Harold's Treasurer duties will remain insofar as to provide financial oversight for the Board, reviewing the monthly financial summaries from the Charity CFO, and finally, any preparation needed for the external audit, but not expense co-approvals
• The Chair will co-approve amounts exceeding the Executive Director's signing limit.
• Harold will not approve his own expenses, including Board travel and contracting fees.
• Harold's duties will primarily be operational in nature, including processing chapter and membership tickets, assisting with operational matters, and ensuring the day-to-day business of the Foundation is conducted in a timely fashion.
• If Harold is still being contracted at the time the election processes kick off, as he is a sitting Board member, he will not be handling any part of the election operational process.

If any actual or perceived conflicts of interest arise, then the Board will follow the Conflict of Interest policy to address any potential breaches."

Sponsor: Marisa Fagan Second: Ashwini Siddhi

• Ashwini Siddhi YES
• Steve Springett YES
• Marisa Fagan YES
• Ricardo Griffith NO
• Kelly Santalucia YES
• Sam Stepanyan NO

Harold Blankenship recused himself from the vote due to the conflict of interest.

Motion Passed 4-2 (1 recusal)

• Strategic plan: Final draft shared; discussion focused on naming/positioning of an “Industry Advisory Council” concept and whether further input from Missy and Stacey was needed. Stacey indicated the document had already been amended toward “industry” wording; a small follow-up meeting was proposed to finalize. (Approx. 00:03:53–00:07:29)
• Staffing / operations: Associate Executive Director role posted (strong initial applicant volume). Community Support Associate hiring to proceed with shortlisting and interviews. Harold has begun contracting; chapter-related ticket volume reportedly declining. (Approx. 00:07:39–00:10:09)
• Events: AppSec Israel postponed from May to October due to uncertainty and sponsor/attendee hesitation; force majeure considerations noted; a small venue payment (~$1,000) discussed as part of rescheduling. Virtual conference moved from 21 Sep to 22 Sep to avoid conflict with Yom Kippur and improve participation. (Approx. 00:10:14–00:12:14)
• Security / IT risk: Vercel breach discussed (OWASP not using affected CLI tooling, but secret rotation and encrypted variable handling planned before website go-live). Noted it has been ~3 years since last IT security review; intent to scope and perform a review (estimated not more than ~$20K). (Approx. 00:12:26–00:14:46)
• Website go-live: Dependent on retesting prior pen-test findings; estimate ~2 weeks. Additional “go-live” readiness tasks mentioned (events, board minutes, etc.). (Approx. 00:14:56–00:16:04)
• Insurance renewal: Renewal partially processed previously; full package renewal in progress, expected late week/early next; commitment made to prevent recurrence via a runbook. (Approx. 00:16:18–00:22:04)
• Runbooks / documentation: Financial operations runbook being created in Confluence; key “undocumented” procedures called out for elections and WASPE awards. (Approx. 00:17:03–00:18:37)
• EU finance/tax: EU bank account established; needs funding (VAT obligations anticipated). Work ongoing to close old ING account and resolve documentation requests (e.g., “certificate of residency” issue). Updates included Portugal tax completion (awaiting authorities) and receipt of Spanish VAT number to close Barcelona VAT return. (Approx. 00:18:41–00:22:25)
• 25th anniversary chapter celebrations: 12 chapter requests received (within budget), with reimbursement guidance and expectation of photos/updates for social media. (Approx. 00:22:28–00:24:25)

• Finance report (Chris Barbeau): March financials showed strong increases in cash, receivables, and net assets; conference-related revenue ahead of plan. Board feedback requested more contextual reporting to avoid misinterpretation of budget vs. actual variances; finance team agreed to update presentation next month to compare YTD vs full-year budget and show year-over-year trends. (Approx. 00:24:56–00:38:18)

• Missie Lindsey presented a two slide deck introducing herself as the new Director of Corporate Support, including her vision for the role and a 90‑day sponsorship roadmap. Immediate priority: contact outstanding renewals (~$150k pipeline) during May. Create tiered sponsorship one‑pager and digital deck for Vienna launch. Early pipeline: $345k in sponsorships; $45k invoiced and active now.

• Avi Douglen provided an update on the progress of the community review of the OWASP Foundation policies. Current "policy review" document needs full rewrite into a policy governance lifecycle. Review team has 7–8 volunteers; team recommends board decisions on structural questions. Ricardo will extract major issues and draft a revised policy for board discussion. Board to schedule a short, unscheduled working session to decide key governance points.

• Stacey Ebbs discussed the finalization of the Strategic Plan. Final strategic plan draft ready for publication on website. Naming resolved as "Industry Advisory Council" pending staff confirmation. Ashwini requested staff input; Stacey confirmed document amended to that wording. Missie to advise on operational approach once onboarded. Design and summary prepared; web publishing awaiting final sign‑off.

• Andrew van der Stock discussed the current status of the website. New website near completion; functional for projects, chapters, events management. Pending actions before go‑live: penetration retest, secret rotation, QA of content. Christian to create admin accounts and enable daily Superbase backups. Andrew to schedule secret rotation and scope an IT security review (~$20k). Migration approach: avoid overwriting chapter leaders' newer data; manual fixes expected.

• Harold contracted; chapter ticket backlog reduced from 71 to 27. Membership and chapter ticket SLA target: respond within three days. Student chapters show abuse and inconsistent activity; board to review pause policy. Sam is restoring the chapter committee to review chapters and set guardrails.

The Board will adjourn to an executive session to discuss a confidential matter. The executive session will be attended only by Board members and any invited guests who are necessary for the discussion. The details of the executive session will be kept confidential and will not be disclosed to the public.