Add SECURITY.md

Also modify bug report issue template to make it clear it's not to be used to report security vulnerabilities. Fixes eclipse-theia#8795 Signed-off-by: Marc Dumais <[email protected]>
marcdumais-work · Jul 29, 2021 · 516d376 · 516d376
1 parent e1c2369
commit 516d376
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/.github/ISSUE_TEMPLATE/bug_report.md b/.github/ISSUE_TEMPLATE/bug_report.md
@@ -1,9 +1,13 @@
 ---
-name: Bug Report
+name: Bug Report (except security vulnerabilities)
 about: Create a report to help us improve
 ---
 
 <!-- Please provide a detailed description of the bug. -->
+<!-- Note: This template is not meant for security vulnerabilities reports -->
+<!-- Any security-related issue, created in this repo, will be deleted on sight -->
+<!-- Instead please report vulnerabilities to the Eclipse Foundation's security team -->
+<!-- For more details, please read SECURITY.md in the repository root -->
 ### Bug Description:
 
 <!-- Please provide clear steps to reproduce the bug. -->

diff --git a/SECURITY.md b/SECURITY.md
@@ -0,0 +1,6 @@
+# Eclipse Theia Security Policy
+## Reporting a vulnerability
+
+Any security vulnerability needs to be reported to the Eclipse Security Team, as
+per the _Eclipse Foundation Security policy_:
+[https://www.eclipse.org/security/](https://www.eclipse.org/security/)