From 8a6773e6c46e8c4a0f22bbc62dc55d601d391ba1 Mon Sep 17 00:00:00 2001 From: Aleksei Igrychev Date: Tue, 1 Sep 2026 16:01:28 +0100 Subject: [PATCH] chore: add security policy Document the responsible disclosure channel and public disclosure process. Previously, the repository did not provide project-level vulnerability reporting guidance. Signed-off-by: Aleksei Igrychev --- SECURITY.md | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..25593907 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,18 @@ +# Security + +## Reporting a vulnerability + +If you find a security related bug, we kindly ask you for responsible +disclosure and for giving us appropriate time to react, analyze and develop a +fix to mitigate the found security vulnerability. + +Please report vulnerabilities by e-mail to the following address: + +* cncf-werf-security@lists.cncf.io + +All vulnerabilities and associated information will be treated with full confidentiality. + +## Public disclosure + +Security vulnerabilities will be disclosed via release notes, and will +credit you for your findings (unless you prefer to stay anonymous, of course).