docs: add SECURITY.md, CONTRIBUTING.md, update maintainer name

2026-07-06 20:02:17 +02:00
parent 5b4aade95f
commit 87518fba99
3 changed files with 89 additions and 1 deletions
@@ -0,0 +1,30 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest ISO build receives security updates. There are no LTS releases.
+
+| Version | Supported |
+|---------|-----------|
+| latest (rolling) | ✅ |
+
+## Reporting a Vulnerability
+
+Please **do not** report security vulnerabilities through public GitHub issues, discussions, or pull requests.
+
+Instead, report via **GitHub Private Vulnerability Reporting** for this repository. If that's unavailable, email `ash8820@proton.me`.
+
+When reporting, include:
+
+- The ISO build date or commit SHA
+- A description of the issue and why it's security-sensitive
+- Steps to reproduce or a proof of concept
+- Any relevant logs, payloads, or screenshots
+- The potential impact
+- Suggested mitigations or fixes, if known
+
+You can expect an acknowledgment within 3 business days. After assessment, I'll work on a fix and coordinate disclosure timing when appropriate.
+
+## Scope
+
+This covers the ISO build system (`buildiso`, profiles, overlays) and the live environment. For issues in custom packages (calamares, branding, keyring), report to the [antergos-packages](https://github.com/Antergos-NeXT/antergos-packages) repo. For upstream Calamares issues, report to [Calamares upstream](https://codeberg.org/calamares/calamares).