Page History

...

Projects that already follow ASF policies and conventions should generally have no problem achieving a 'passing' grade for the badge, and are encouraged to do so. This page provides some pointers that might be helpful, feel free to add additional information.

Start your project name with "Apache" so it shows up in the alphabetical listing at https://www.bestpractices.dev/en/projects?page=12&sort=name. It probably makes sense to manage your listing under a PMC or Security Team account, i.e. private@yourproject.apache.org or security@yourproject.apache.org.

Private vulnerability reporting

...

The release notes MUST identify every publicly known run-time vulnerability fixed in this release that already had a CVE assignment or similar when the release was created. According to ASF policy advisories are published 'at the same time as or after' a release. The Best Practices badge narrows this to 'at the same time as' the publication of release notes. For ASF projects this typically means the CVE will not be part of the release notes at the time of voting for the release, but are added when the release notes are published along with the release.

...