docs: publish vulnerability remediation targets

[Erik Osterman (Cloud Posse) (osterman)]

what

• Adds a Remediation Targets section to the organization security policy: Critical 7 days (72 hours where reachable with an upstream fix available), High 30 days, Medium 90 days, Low next regular release.
• Targets are measured from confirmation rather than from the report date.
• Scoped with the sentence "These targets apply to Cloud Posse's actively maintained software products, including the Atmos CLI."

why

• These targets were approved internally but have never been published, so an assessor reading https://github.com/cloudposse/atmos/security/policy sees a disclosure process with no remediation commitment. A published SLA is expected evidence in supply-chain assessments and for Iron Bank.
• This file is the organization-level default, inherited by every Cloud Posse repository. A repository-local SECURITY.md would override the whole file for that repo, which means maintaining two nearly identical copies — so the targets go here instead, with an explicit scoping sentence so they do not read as a commitment across dormant module repositories.

Reviewers: the scoping sentence is the part worth arguing about. "Actively maintained software products" is deliberately narrower than "every repository in this organization." If we would rather commit organization-wide, drop that qualifier.

references

• Raised during the Atmos supply-chain security assessment.
• Related: cloudposse/atmos PR adding docs/SSDLC.md, whose Section 8 cites these same targets.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Uaxw8BszrDDBNmyFTcDrTx

[Kevin (kevcube)]

👍