From d6ce67837f5ed1bc6be1a0211c8598e5679d4fd3 Mon Sep 17 00:00:00 2001
From: Chuck McAndrew <6248903+dcmcand@users.noreply.github.com>
Date: Fri, 9 Oct 2026 12:38:49 +0200
Subject: [PATCH] docs: add SECURITY.md with private vulnerability reporting
 policy

---
 SECURITY.md | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..52d5811
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,35 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are made on `main` and shipped in the next release. Only the most recent release receives fixes; older releases are not patched. If you can, please confirm the issue against the latest release or `main` before reporting.
+
+## Reporting a Vulnerability
+
+Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
+
+Report them privately through GitHub's private vulnerability reporting: [open a new advisory](https://github.com/nebari-dev/software-pack-template/security/advisories/new). Only the maintainers can see the report.
+
+Please include as much of the following as you can:
+
+- The version of this template you are running, and where it is deployed
+- Steps to reproduce, or a proof of concept
+- The impact as you understand it, including what an attacker would need to exploit it
+
+## What to Expect
+
+The maintainers will acknowledge the report, work with you to confirm and understand the issue, and keep you updated on progress toward a fix. Once a fix is released, we will publish a GitHub Security Advisory and credit you unless you ask us not to.
+
+Please give us a reasonable chance to release a fix before disclosing the issue publicly.
+
+## Scope
+
+In scope:
+
+- The template's chart, workflows, and default configuration that new packs inherit
+
+Out of scope here:
+
+- Vulnerabilities in a pack generated from this template; report those to that pack's repository
+- Vulnerabilities in the Nebari platform itself; report those to [Nebari Infrastructure Core](https://github.com/nebari-dev/nebari-infrastructure-core/security/advisories/new) or [nebari-operator](https://github.com/nebari-dev/nebari-operator/security/advisories/new)
+- Issues that require an attacker to already hold cluster-admin or cloud-account administrator credentials