From 8dfa5f61917ae9d9af50b0b9d565bf5ddb65d5a9 Mon Sep 17 00:00:00 2001 From: Antony Pegg Date: Thu, 3 Sep 2026 08:57:20 -0400 Subject: [PATCH] docs: add SECURITY.md Points at security@pgedge.com as the single reporting route and at the pgEdge Vulnerability Disclosure Statement at docs.pgedge.com/security for scope, safe harbour and CVE handling. Identical across every pgEdge product repository, and byte-identical to the organisation default on pgEdge/.github. --- SECURITY.md | 37 +++++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..33ebccb1 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,37 @@ +# Security Policy + +## Reporting a Vulnerability + +Please report security vulnerabilities to +[**security@pgedge.com**](mailto:security@pgedge.com), which reaches the +pgEdge security team. + +Please do not open a public issue for a suspected vulnerability. + +Tell us the product and version, what the impact is, and how to reproduce +it. You do not need to sign anything or hold a pgEdge contract to report to +us. + +We acknowledge reports within five business days, tell you the outcome of +our assessment, and tell you before we publish anything. + +## Supported Versions + +Security fixes are provided for the latest release of each product. Where a +product has its own published support lifecycle, that lifecycle governs. + +## Scope and Safe Harbour + +What is in scope, our safe harbour terms, and how we handle coordinated +disclosure and CVE identifiers are all set out in the pgEdge Vulnerability +Disclosure Statement: + +[**https://docs.pgedge.com/security**](https://docs.pgedge.com/security) + +You may test this software freely in an environment you control. Testing +pgEdge Cloud requires prior written authorisation — see the statement. + +## Published Advisories + +Advisories are published under the Security tab of the repository for the +affected product.