Add SECURITY.md for CRA

[nmars]

Added SECURITY.md for EU Cyber Resilience Act compliance

For: CLOUDDST-32840

[qodo-for-releng]

PR Summary by Qodo

Add SECURITY.md with vulnerability reporting and CRA steward statement

📝 Documentation 🕐 Less than 5 minutes

AI Description

• Add SECURITY.md outlining private vulnerability/incident reporting process
• Document response timeline and required submission details for coordinated disclosure
• Include EU Cyber Resilience Act open-source steward statement and Red Hat policy links

High-Level Assessment

The approach is appropriate for compliance and contributor guidance: a repository-level SECURITY.md is the standard, GitHub-recognized location for security reporting instructions, and it cleanly references Red Hat’s existing disclosure and vulnerability management policies.

Files changed (1) +41 / -0

Documentation (1) +41 / -0

SECURITY.mdAdd security vulnerability reporting policy and CRA steward statement +41/-0

Add security vulnerability reporting policy and CRA steward statement

• Introduces a SECURITY.md describing how to privately report security vulnerabilities/incidents, including expected response timeline and required triage metadata. Adds an EU Cyber Resilience Act open-source steward statement and links to Red Hat’s coordinated disclosure and security practices.

SECURITY.md

[qodo-for-releng]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can tweak Display preferences with a live preview to see your comment before it ships

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:26 PM UTC · Completed 6:37 PM UTC

Commit: f24cab1 · View workflow run →

[fullsend-ai-review]

Review

Findings

Low

• [heading-style-consistency] SECURITY.md:1 — All section headings (lines 1, 9, 13, 26, 32, 36) use both ATX-style (#) and bold (**) formatting, which is inconsistent with the established pattern in README.md and CHANGELOG.md where headings use ATX-style without additional bold formatting.
  Remediation: Remove the ** bold markers from all section headings.

Info

• [email-formatting] SECURITY.md:5 — Email addresses use italic formatting with manually escaped @ characters (_exd-guild-hello-operator-admins\[at\]redhat.com_). This pattern is not found elsewhere in the repository's documentation. May be an intentional obfuscation pattern for security documentation.

---

Labels: PR adds a SECURITY.md documentation file for CRA compliance

[fullsend-ai-review]

[low] heading-style-consistency

All section headings (lines 1, 9, 13, 26, 32, 36) use both ATX-style (#) and bold (**) formatting, which is inconsistent with the established pattern in README.md and CHANGELOG.md where headings use ATX-style without additional bold formatting.

Suggested fix: Remove the ** bold markers from all section headings.

[nmars]

Understood. This is due to using this as a template: https://github.com/RedHatProductSecurity/CRA/blob/main/Templates/Security_MD_template.md?plain=1

I can change the headings to fit the conventions of other markdown docs in this repo.