From 8f8258c3f096c5a87fb1479edc6e14ea56376ef8 Mon Sep 17 00:00:00 2001
From: Achilleas Koutsou <achilleas@koutsou.net>
Date: Tue, 11 Aug 2026 12:32:53 +0200
Subject: [PATCH] Add Security policy page to main navigation bar

Add a security policy and link to it from the main navigation bar
(sidebar).  Each project will link to this general policy from their own
SECURITY.md files for better discoverability.

There do not seem to be strict guidelines for the contents of this
policy and in fact appears to be optional, while the SECURITY.md files
in each repo are required.  However, I think a central policy that we
link to from each repository makes it easier to update or clarify the
general policy from one location and helps with discoverability.

HMS-10902
---
 docs/security/00-index.md | 19 +++++++++++++++++++
 docusaurus.config.ts      |  6 ++++++
 sidebars.ts               |  3 +++
 3 files changed, 28 insertions(+)
 create mode 100644 docs/security/00-index.md

diff --git a/docs/security/00-index.md b/docs/security/00-index.md
new file mode 100644
index 00000000000..2e0054eb5ea
--- /dev/null
+++ b/docs/security/00-index.md
@@ -0,0 +1,19 @@
+# Vulnerability Management and Incident Response Policy
+
+## 1. Reporting
+
+- Report security vulnerabilities via email to [osbuilders@redhat.com](mailto:osbuilders@redhat.com).
+- Do not open public issues or submit public pull requests for undisclosed security vulnerabilities.
+- Include a technical description, steps to reproduce, a proof of concept (if available), and the suspected impact.
+
+## 2. Triage and Response
+
+- The core maintainer team will acknowledge receipt of the vulnerability report within 72 hours.
+- The incident response team will assign a severity level during triage.
+- The reporter may receive status updates weekly through the email address used to report the vulnerability.
+
+## 3. Public Disclosure
+
+- Public disclosure occurs strictly after a patch is released and integrated into the primary branch.
+- A CVE identifier will be requested when appropriate.
+- The reporter will be credited in the public security advisory and release notes unless anonymity is explicitly requested.
diff --git a/docusaurus.config.ts b/docusaurus.config.ts
index 77e650979fc..8c0e6647979 100644
--- a/docusaurus.config.ts
+++ b/docusaurus.config.ts
@@ -104,6 +104,12 @@ const config: Config = {
           position: 'left',
           label: 'Developer Guide',
         },
+        {
+          type: 'docSidebar',
+          sidebarId: 'security',
+          position: 'left',
+          label: 'Security',
+        },
         {
           href: 'https://github.com/osbuild/',
           label: 'GitHub',
diff --git a/sidebars.ts b/sidebars.ts
index 9c4eb45e455..32589ba1e4c 100644
--- a/sidebars.ts
+++ b/sidebars.ts
@@ -27,6 +27,9 @@ const sidebars: SidebarsConfig = {
   developer: [
     {type: 'autogenerated', dirName: 'developer-guide'},
   ],
+  security: [
+    {type: 'autogenerated', dirName: 'security'},
+  ],
 
   // But you can create a sidebar manually
   /*