diff --git a/docs/demos/lcore/cve_hermetic_build.html b/docs/demos/lcore/cve_hermetic_build.html
new file mode 100644
index 000000000..af3a9183d
--- /dev/null
+++ b/docs/demos/lcore/cve_hermetic_build.html
@@ -0,0 +1,35 @@
+
+
+
+
+
+ Fixing CVEs in hermetic build environment
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/docs/demos/lcore/cve_hermetic_build.md b/docs/demos/lcore/cve_hermetic_build.md
new file mode 100644
index 000000000..26bd64130
--- /dev/null
+++ b/docs/demos/lcore/cve_hermetic_build.md
@@ -0,0 +1,54 @@
+# Lightspeed Core
+
+
+
+---
+
+# Fixing CVEs in hermetic build environment
+
+Pavel Tišnovský,
+ptisnovs@redhat.com
+
+---
+
+## Hermetic build
+
+* Downloads all sdists
+* Network is disabled
+* All packages are built w/o network access
+* Results will be added into the dest. image
+
+---
+
+## Types of packages
+
+* With sources (sdist)
+* With sources, but with time consuming build
+* Without sources (binary wheels)
+* `pip` is special a bit
+
+---
+
+## Solution proposed by RH
+
+* Standard Python registry
+* RH Python registry with pre-built packages
+
+---
+
+## How to fix CVE?
+
+* Package in PyPi?
+ - update lockfile + requirements file
+ - ETA - hours
+* Package in RH Python registry
+ - ask on forum-aipcc
+ - exact workflow to be defined + refined
+ - ETA - days (!!!)
+* `pip` package
+ - dunno ATM :(
+
+---
+
+## Thank you
+