Skip to content

Add CRA steward section and SECURITY.md reference to security docs [HMS-10902] #214

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
achilleas-k merged 1 commit into from
Aug 25, 2026
Merged

Add CRA steward section and SECURITY.md reference to security docs [HMS-10902] #214

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions docs/security/00-index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
# Vulnerability Management and Incident Response Policy

For a quick overview of how to report vulnerabilities, see the organization-wide [SECURITY.md](https://github.com/osbuild/.github/blob/main/SECURITY.md) file, which applies to all repositories under the osbuild GitHub organization.

## 1. Reporting

- Report security vulnerabilities via email to [osbuilders@redhat.com](mailto:osbuilders@redhat.com).
Expand All @@ -17,3 +19,11 @@
- Public disclosure occurs strictly after a patch is released and integrated into the primary branch.
- A CVE identifier will be requested when appropriate.
- The reporter will be credited in the public security advisory and release notes unless anonymity is explicitly requested.

## 4. EU Cyber Resilience Act

This project is stewarded by **Red Hat, Inc.**, an open source software steward as defined in Article 3(14) of the [EU Cyber Resilience Act (Regulation 2024/2847)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng). Contact: [cra-steward@redhat.com](mailto:cra-steward@redhat.com)

If you become aware of an **actively exploited vulnerability** or a **severe incident** affecting this project, please report it promptly — see [Reporting Actively Exploited Vulnerabilities and Severe Incidents](https://github.com/RedHatProductSecurity/CRA/blob/main/Guidelines/eu-cra-incident-and-vulnerability-reporting-guidelines.md) for the process and timelines.

For Red Hat's general security practices, see [Red Hat Product Security](https://access.redhat.com/security/).