From 14420dabed1be339fc8f9a41b83784610a0cb8af Mon Sep 17 00:00:00 2001 From: Blai Peidro Date: Wed, 12 Aug 2026 04:50:08 +0200 Subject: [PATCH] Point security reports at security@ctrliq.com SECURITY.md was inherited unchanged from awx-operator and directs vulnerability reports to security@ansible.com, which routes disclosures for this operator to a project that does not maintain it. Replace it with the same policy already used in ctrliq/ascender-collection, reporting to security@ctrliq.com. --- SECURITY.md | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 2e8815a3..15558f5b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,3 +1,28 @@ -For all security related bugs, email security@ansible.com instead of using this issue tracker and you will receive a prompt response. +# Security Policy -For more information on the Ansible community's practices regarding responsible disclosure, see https://www.ansible.com/security +## Supported Versions + +| Version | Supported | +| ------- | ------------------ | +| 25.x | :white_check_mark: | +| < 25.0 | :x: | + +## Reporting a Vulnerability + +If you discover a security vulnerability in this project, please report it +responsibly. **Do not open a public GitHub issue for security vulnerabilities.** + +Instead, please send an email to **security@ctrliq.com** with: + +- A description of the vulnerability +- Steps to reproduce the issue +- Any potential impact + +You should receive a response within 72 hours acknowledging receipt. We will +work with you to understand the issue and coordinate a fix and disclosure +timeline. + +## Disclosure Policy + +We follow coordinated disclosure. We ask that you give us a reasonable amount +of time to address the issue before making any information public.