tym83andClaude 60704530ed docs(security): align security docs with current controls for incubation DD ...

Bring the security documentation in line with controls that are already
in place, and add the two coordinated-disclosure items flagged during the
incubation due-diligence review.

- self-assessment: DCO is enforced by an automated check; private intake
  is GitHub Private Vulnerability Reporting; OpenSSF passing badge achieved
  2026-04-01 (working toward silver); GHSA/PVR framing for advisory history;
  incident-response now summarized publicly.
- SECURITY.md: route reports to Private Vulnerability Reporting with a
  MAINTAINERS.md fallback; add a 90-day coordinated-disclosure window and a
  CVSS-based remediation-target table.
- CODEOWNERS: document that it encodes the area-scoped Reviewer role, which
  is intentionally distinct from the MAINTAINERS.md governance roster, and
  that security reporting is not routed through this file.
- Add docs/security/incident-response.md as the public incident runbook.

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: tym83 <6355522@gmail.com>

2026-07-07 13:52:17 +05:00

..

incident-response.md

docs(security): align security docs with current controls for incubation DD

2026-07-07 13:52:17 +05:00

self-assessment.md

docs(security): align security docs with current controls for incubation DD

2026-07-07 13:52:17 +05:00

threat-model.md

docs(security): add design-level threat model

2026-07-06 18:23:11 +03:00