Skip to content

docs(security): rewrite security policy page - #155

Merged
xmudrii merged 2 commits into
mainfrom
security-rewrite
May 8, 2026
Merged

docs(security): rewrite security policy page#155
xmudrii merged 2 commits into
mainfrom
security-rewrite

Conversation

@xmudrii

@xmudrii xmudrii commented May 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Complete rewrite of reference/security/index.md to improve clarity, accuracy, and usefulness for both end users and vulnerability reporters.

Policy changes

  • Acknowledgement SLA removed
  • CVD commitments section moved here from SECURITY.md and rewritten in third-person; this page is now the authoritative source, to be linked from SECURITY.md
  • Added PlatformMesh-Announcement mailing list as a channel for security fix announcements and high/critical pre-announcements
  • Scanner-only reports: clarified handling with explicit outcomes — confirmed reachable → handled as vulnerability; not reachable → reporter notified and report closed
  • Dependency vulnerability exception now requires the vulnerability to be rated high or critical and confirmed exploitable in Platform Mesh
  • Removed duplicated pre-announcement bullet block from the dependency section (was copy-pasted from the direct reports section)
  • Backporting policy simplified — removed reference to a non-existent per-repository policy

Structural changes

  • "Staying Up to Date" moved before "Reporting Vulnerabilities" to prioritise the end user audience
  • "Information Disclosure" promoted from #### to ### and moved after "Vulnerabilities in Dependencies", as it applies to both sections
  • Subscription guidance converted to a bullet list

Style and wording

  • All headings converted to title case
  • Consistent third-person voice throughout
  • Numerous wording improvements for clarity and formality

cc @mirzakopic

@xmudrii
docs(security): rewrite security policy page
d84395b 
On-behalf-of: @SAP marko.mudrinic@sap.com
Signed-off-by: Marko Mudrinić <mudrinic.mare@gmail.com>
@github-actions

github-actions Bot commented May 7, 2026 •
edited
Loading

Copy link
Copy Markdown
PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-05-08 08:48 UTC

@xmudrii
xmudrii requested a review from mirzakopic May 7, 2026 14:02
This was referenced May 7, 2026
Merged
Closed
mirzakopic
mirzakopic reviewed May 8, 2026
View reviewed changes
Comment thread reference/security/index.md Resolved
Comment thread reference/security/index.md Resolved
Comment thread reference/security/index.md Resolved
Comment thread reference/security/index.md Resolved
Comment thread reference/security/index.md Resolved
Comment thread reference/security/index.md Resolved
Comment thread reference/security/index.md Resolved
Comment thread reference/security/index.md Resolved
Comment thread reference/security/index.md Resolved
Comment thread reference/security/index.md Resolved
@xmudrii @mirzakopic
Apply suggestions from code review
be4069d 
On-behalf-of: @SAP marko.mudrinic@sap.com
Signed-off-by: Marko Mudrinić <mudrinic.mare@gmail.com>
Co-authored-by: Mirza Kopic <1658560+mirzakopic@users.noreply.github.com>
@xmudrii
xmudrii force-pushed the security-rewrite branch from 00c2310 to be4069d Compare May 8, 2026 08:32
@xmudrii
xmudrii requested a review from mirzakopic May 8, 2026 08:33
@xmudrii
xmudrii merged commit 71dfb02 into main May 8, 2026
4 checks passed
@xmudrii
xmudrii deleted the security-rewrite branch May 8, 2026 08:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mirzakopic mirzakopic mirzakopic approved these changes
@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@xmudrii @mirzakopic