<style>
.present {
font-size: 25px;
}
ul {
margin: 1em;
}
</style>
<!-- TBD whether I'll use slide mode here (https://docs.hedgedoc.org/references/slide-options/), or use pandoc to create a PDF out of this page -->
## OCaml security team address
<!--
When? https://ocaml.org/ocaml-workshop-2026/schedule
Aug 24th, 09:50-10:00
Keep this short, ideally should fit on one (or two, it is a bit crowded for just 1) slides
-->
* Am I potentially affected by a security issue?
```bash
$ opam install opam-audit
$ opam audit
opam-audit: [WARNING] mirage-crypto.2.0.1 has the known vulnerability OSEC-2026-12:
AEAD `decrypt_into` functions writes plaintext before checking the tag
(read full advisory https://osv.dev/vulnerability/OSEC-2026-12)
```
* Advisories:
* https://osv.dev/list?q=&ecosystem=opam
* https://storage.googleapis.com/osv-vulnerabilities/opam/modified_id.csv
* announcements: https://sympa.inria.fr/sympa/info/ocsf-ocaml-security-announcements
* Reporting an issue
* https://ocaml.org/security#reporting-security-issues
* [what is needed in a report?](https://github.com/ocaml/security-advisories#what-is-needed-in-a-report-about-a-security-issue)<!-- click on the 2nd link and talk briefly about what to include -->
* Stats for 2026: 17 advisories, 11 packages, 3 in the OCaml distribution
---
* More information<!-- All the information on this slide can be found by following the links from the last 2026 report on discuss.ocaml.org.
For convenience this is shown both as a URL and as a QR code.
--> 
https://discuss.ocaml.org/t/ocaml-security-team-report-for-first-half-of-2026/18366/2
* [Last public security meeting](https://discuss.ocaml.org/t/public-security-meeting/17882), next public meeting: **Tuesday Sep 15th 14:00 CEST**<!-- mention that there was a public security team meeting, and that everyone is welcome to attend the next one, no registration required
TBD: would be good if we had a date in mind here?
-->
* Some of the [Security Team members](https://ocaml.org/security#ocaml-security-response-team) are here, come and talk to us<!-- ask for feedback, perhaps the security team members who are present at the conference could briefly stand up, or be all present jointly on stage, TBD.
Make it clear that this is just for the conference, in general security issues or concerns must be reported on the security email instead of individually to team members!
-->
* [Security grants](https://discuss.ocaml.org/t/ocaml-security-grants/17754)<!-- maybe a brief update on timelines -->
* [what to do with vulnerable packages?](https://discuss.ocaml.org/t/request-for-comments-what-to-do-with-opam-packages-that-have-known-security-vulnerabilities/18087)
* Pre-notification for vulnerabilities?
* an initiative of the [OCaml Software Foundation](https://ocaml-sf.org/) <!-- don't forget to mention who is sponsoring this -->
<!-- leave time for questions! -->
---