September 2026 Videoconference

• 25th anniversary: the anniversary virtual conference was under way, with over 600 registrants expected.

• Distinguished Lifetime Members: the board must send its decision to Lauren soon so plaques are ready for AppSec San Francisco.

• Wiki retirement: Andrew proposed shutting off the wiki, now 7+ years stale and unindexed since 2021, as it carries security risk from hundreds of plugins. Sam asked to keep a static, read-only archive; they will resolve this offline.

• Subdomain takeover: a Brazilian firm took over a documentation project's subdomain after a deployment removed the CNAME, without first using the VDP. Harold has fixed it. Moving all DNS, including leader-controlled domains, to Cloudflare will reduce future risk.

• Elections: candidates and the call for questions are published. The Monday.com question form is broken and will be fixed. The candidates' debate panel is on 6 October.

• Operations (Lori Meagher): a draft accounts receivable (AR) process is under review with Charity CFO. A succession plan for key roles is being prepared. The corporate card will move from Charity Card to Chase One Card by year end, removing the need for Dext.

Charity CFO's video report showed strong results to the end of August.

Cash on hand is $1.9M (4.5 months, excluding CDs), the current ratio is 17:1 and net assets are $3.3M. Conferences provide 84% of revenue. Receivables over 90 days are $410K (July $403K), with about $47K written off last month; total AR is about $600K. Andrew has asked corporate counsel for corporate supporter and project sponsorship contract templates, so future revenue is backed by a contract or purchase order. Links in the agenda were broken and have been fixed; directors may ask further questions on notice.

OWASP has no immediate CRA reporting obligation, but must clarify its open source steward role and publish community guidance.

• Status (Starr Brown): owasp.org/security is live with vulnerability reporting guidance. A SECURITY.md template will go to all code repos as an org-wide PR, mandatory by 31 October unless a project has a compliant policy. The Executive Director has approved a paid CRA liaison position in principle; scope, hours and rate are still to be defined.

• Incident reporting (Olle Johansson): the Commission clarified that open source stewards are not expected to file incident reports until the Act fully applies on 11 December 2027. ENISA will not accept open source reports via its portal; incidents can go to national CERTs.

• Steward scope: some projects have a commercial entity that may act as steward instead. The board wants a clear public list of projects OWASP stewards. Projects will be tagged by category; intentionally vulnerable training projects (e.g. Juice Shop, WebGoat) must be clearly marked as not for commercial use.

• Manufacturer due diligence: OWASP already receives repetitive vendor questionnaires. Olle and Starr offered to prepare a page to point requesters to. The ORC WG is promoting "respectful due diligence". Paid project attestations may become a revenue stream once the Commission issues its delegated act.

• Secure coding policy: OWASP needs one as a steward. Eclipse (under the MOU) has offered help; the ORC WG is starting a steward group that leaders could join.

• Community resources: Sam proposed a CRA readiness project or working group, as leaders lack published guidance. The Chair and Olle agreed the steward obligation must be led by the board and staff, while manufacturer and chapter engagement could be a community project.

• Clarity of materials: Ricardo noted the slide wording "approved funding" was misleading, since only the role was approved. Staff will correct it.

Ricardo asked for a clear preparation standard: complete materials at least 3 days before each meeting, preferably a week in advance, with named owners. The Chair agreed that other directors share this concern and suggested rescheduling meetings around the financial reporting cycle.

Andrew explained that management reports arrive around the 18th, leaving 3 days before this month's early meeting. He committed to publishing slides at the draft agenda stage and having them complete at the final agenda. The December meeting (16 December) will precede month-end financials, so it will focus on the 2027 budget. Lori is reviewing the option of bringing more financial reporting in-house. The matter will be resolved offline.

Since launch, 74 issues have been closed, and 44 remain open. Fixes include project classifications, chapter leader names, OpenGraph/SEO, board voting history back to 2011, director attendance, policy search, the security/VDP page, and support documentation that routes users to the right Jira ticket type.

Sam thanked the staff and raised the remaining 404s, search gaps, and syncing content with GitHub and OWASP Nest; Andrew will meet with Arkadii on the Nest integration. The Chair stated the board's objective of an easy corporate supporter and donor journey has not yet been met. A working group (including the Chair, Missy, and Stacey) will redesign the Support OWASP page starting in early October, including the removal of the $500 donation cap.

Only about 3 of the 6 policies planned for 2026 are likely to finish this year.

• AI policy (Andrew, Ashwini): near final. Ashwini's and community comments are being incorporated, including whether to add examples of acceptable use. Community review is expected within about a week, aiming for a vote at the late-November meeting.

• Social media policy: largely ready; Ashwini will review.

• Community review policy (Ricardo): still in draft with Avi. Other policies are not blocked, as the Policy Review Team is now in place and the current policy applies.

• Committee policy (Harold): open as a PR since April with board and PRT comments. Harold will move it to a Google Doc for comments and schedule working sessions. Andrew suggested moving handbook-style content out of the policy.

• Possible fourth policy: Andrew suggested amending the membership policy to specify which privileges are lost upon revocation, including the use of OWASP marks, and to align with a matching social media policy change. He will confirm the priority list on notice.

WISP's ask remains $50,000, tied to about four deliverables (e.g., GRC, legal, events, and bringing communities to chapters). Starr will invite WISP to present at the in-person board meeting in San Francisco.

• Ashwini asked for WISP's strategy, impact data, and growth plans, and why WISP over other groups.

• Andrew noted WISP's complementary membership and reach.

• The Chair suggested that $50,000 may be too little, but wants a concrete plan to engage WISP members in OWASP events.

• Kelly asked whether a formal partnership could replace paid services; Andrew noted WISP could potentially come under OWASP's umbrella, subject to checking the certificate of incorporation.

• Discussion broadened to co-located tracks (e.g., GRC or compliance) at future Global AppSec venues; San Francisco 2026 is fully booked.

• Starr Brown, Olle Johansson: define the CRA liaison scope, hours, and rate, and bring a funding request to the board

• Starr Brown: send the org-wide SECURITY.md PR (compliance due 31 October) and publish which projects OWASP stewards

• Olle Johansson, Starr Brown: prepare a web page to answer manufacturer due-diligence questionnaires

• Andrew van der Stock: forward recent vendor questionnaires to Olle

• Andrew van der Stock: correct the CRA slide to say the liaison role, not funding, was approved

• Steve Springett: consider a CRA working session at the San Francisco in-person meeting

• Andrew van der Stock: publish board slides with the draft agenda and complete them by the final agenda; work with directors offline on a preparation standard and meeting schedule

• Lori Meagher: share the finalized AR process with Ricardo and interested directors; present her 90-day report at the October meeting (early November)

• Directors: send the Distinguished Lifetime Member decision to Lauren in time for plaques

• Andrew van der Stock, Sam Stepanyan: agree on an approach to retiring or archiving the wiki

• Andrew van der Stock: fix the election questions form on Monday.com

• Andrew van der Stock: meet Arkadii on OWASP Nest integration; convene the Support OWASP page working group in early October

• Andrew van der Stock: incorporate comments and release the AI policy for community review

• Ashwini Siddhi: review the social media policy

• Harold Blankenship: move the committee policy to a Google Doc and schedule working sessions, inviting Andrew and Sam

• Andrew van der Stock: confirm on notice which further policy should be prioritized this year

• Starr Brown: invite WISP to present at the San Francisco board meeting, with strategy, impact data and four concrete deliverables

• Steve Springett: draft the agenda for the in-person San Francisco meeting

• Andrew van der Stock: request a one-week trial of the board management platform; directors to suggest alternatives