From 2f41c6ad04a8f4423a6b5d579844d3243061e913 Mon Sep 17 00:00:00 2001 From: Antony Pegg Date: Thu, 20 Aug 2026 10:44:42 -0400 Subject: [PATCH 1/2] docs: add org-wide SECURITY.md default GitHub applies a SECURITY.md from this repository to every pgEdge repository that does not carry its own, including ones created later, so this one commit covers the whole org. Nothing in the file is repo-specific. It names security@pgedge.com as the single reporting route and points at the Vulnerability Disclosure Statement for scope, safe harbour and CVE handling. Do not merge before pgEdge/pgedge-docs#138. That PR publishes docs.pgedge.com/security, which is the only link in this file; until it merges the URL returns 404. --- SECURITY.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..3ba2905 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,36 @@ +# Security Policy + +## Reporting a Vulnerability + +Please report security vulnerabilities to **security@pgedge.com**, which +reaches the pgEdge security team. + +Please do not open a public issue for a suspected vulnerability. + +Tell us the product and version, what the impact is, and how to reproduce +it. You do not need to sign anything or hold a pgEdge contract to report to +us. + +We acknowledge reports within five business days, tell you the outcome of +our assessment, and tell you before we publish anything. + +## Supported Versions + +Security fixes are provided for the latest release of each product. Where a +product has its own published support lifecycle, that lifecycle governs. + +## Scope and Safe Harbour + +What is in scope, our safe harbour terms, and how we handle coordinated +disclosure and CVE identifiers are all set out in the pgEdge Vulnerability +Disclosure Statement: + +**https://docs.pgedge.com/security** + +You may test this software freely in an environment you control. Testing +pgEdge Cloud requires prior written authorisation — see the statement. + +## Published Advisories + +Advisories are published under the Security tab of the repository for the +affected product. From d662b0dfa7f70bfcaf80a95959955d56c8b2b9f0 Mon Sep 17 00:00:00 2001 From: Antony Pegg Date: Fri, 21 Aug 2026 12:33:59 -0400 Subject: [PATCH 2/2] docs: make the SECURITY.md links clickable The statement URL and the reporting address were bare text. Dave asked for the URL to be a real link on pgedge-safesession#73: GitHub autolinks it, but nothing guarantees another viewer will, and the two actionable things in a security policy should not depend on a renderer. The published statement at docs.pgedge.com/security already writes the address as an explicit mailto link, so this keeps the two documents consistent. Identical across every repo carrying this file. --- SECURITY.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 3ba2905..33ebccb 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,8 +2,9 @@ ## Reporting a Vulnerability -Please report security vulnerabilities to **security@pgedge.com**, which -reaches the pgEdge security team. +Please report security vulnerabilities to +[**security@pgedge.com**](mailto:security@pgedge.com), which reaches the +pgEdge security team. Please do not open a public issue for a suspected vulnerability. @@ -25,7 +26,7 @@ What is in scope, our safe harbour terms, and how we handle coordinated disclosure and CVE identifiers are all set out in the pgEdge Vulnerability Disclosure Statement: -**https://docs.pgedge.com/security** +[**https://docs.pgedge.com/security**](https://docs.pgedge.com/security) You may test this software freely in an environment you control. Testing pgEdge Cloud requires prior written authorisation — see the statement.