[alangou]

Summary

Propose a concise, project-specific SECURITY.md using GitHub private vulnerability reporting and GitHub Security Advisories (GHSA), inspired by the CNCF template. Require a common report format and supporting evidence, with optional contributor workflows for drafting and reviewing advisories.

Related Issue

No linked issue.

Related pull requests

Parent of #4872. Merge #4872 into docs/security-ghsa/alangou first, then merge this PR into main to land the security policy, report template, and contributor skills together.

Changes

• Make GitHub private reporting the only vulnerability intake channel and explain the information to include.
• Require human review of submitted findings and return reports missing the required format or concrete evidence for revision before technical triage.
• Add the required report template and optional contributor authoring/review workflows from docs(skills): add structured security advisory authoring #4872.
• Describe maintainer follow-up, coordinated disclosure, and published advisories without numerical response deadlines.
• Align supported versions with RFC 0014: the newest patch of stable minor N and N-1.

Before adopting this policy, align the issue chooser's existing PSIRT wording and confirm the responder and notification setup; these are not included in this draft.

Testing

• Markdownlint passed for all seven affected Markdown files in the combined stack; the advisory description fragment is exempt from the first-level heading requirement.
• Both skill validators passed; contributor inventory, internal metadata, and nine relative links are consistent.
• git diff --check passed; verified that the child PR contains only the six skill-related files.

Rust, SDK, and E2E suites are not applicable to these documentation changes. GitHub advisory creation was not exercised.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable)

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.