From 8906ab5abcf0c6e42d99808694775c6d1df0baa6 Mon Sep 17 00:00:00 2001 From: Antony Pegg Date: Thu, 20 Aug 2026 10:47:39 -0400 Subject: [PATCH 1/2] docs: add SECURITY.md Points at security@pgedge.com as the single reporting route and at the pgEdge Vulnerability Disclosure Statement for scope, safe harbour and CVE handling. Identical across every pgEdge product repository. Do not merge before pgEdge/pgedge-docs#138 publishes docs.pgedge.com/security; until it does, the only link in this file 404s. --- SECURITY.md | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..3ba2905 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,36 @@ +# Security Policy + +## Reporting a Vulnerability + +Please report security vulnerabilities to **security@pgedge.com**, which +reaches the pgEdge security team. + +Please do not open a public issue for a suspected vulnerability. + +Tell us the product and version, what the impact is, and how to reproduce +it. You do not need to sign anything or hold a pgEdge contract to report to +us. + +We acknowledge reports within five business days, tell you the outcome of +our assessment, and tell you before we publish anything. + +## Supported Versions + +Security fixes are provided for the latest release of each product. Where a +product has its own published support lifecycle, that lifecycle governs. + +## Scope and Safe Harbour + +What is in scope, our safe harbour terms, and how we handle coordinated +disclosure and CVE identifiers are all set out in the pgEdge Vulnerability +Disclosure Statement: + +**https://docs.pgedge.com/security** + +You may test this software freely in an environment you control. Testing +pgEdge Cloud requires prior written authorisation — see the statement. + +## Published Advisories + +Advisories are published under the Security tab of the repository for the +affected product. From b8470123d387f50f8da5593ed26e1294aa002e88 Mon Sep 17 00:00:00 2001 From: Antony Pegg Date: Fri, 21 Aug 2026 12:34:01 -0400 Subject: [PATCH 2/2] docs: make the SECURITY.md links clickable The statement URL and the reporting address were bare text. Dave asked for the URL to be a real link on pgedge-safesession#73: GitHub autolinks it, but nothing guarantees another viewer will, and the two actionable things in a security policy should not depend on a renderer. The published statement at docs.pgedge.com/security already writes the address as an explicit mailto link, so this keeps the two documents consistent. Identical across every repo carrying this file. --- SECURITY.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 3ba2905..33ebccb 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,8 +2,9 @@ ## Reporting a Vulnerability -Please report security vulnerabilities to **security@pgedge.com**, which -reaches the pgEdge security team. +Please report security vulnerabilities to +[**security@pgedge.com**](mailto:security@pgedge.com), which reaches the +pgEdge security team. Please do not open a public issue for a suspected vulnerability. @@ -25,7 +26,7 @@ What is in scope, our safe harbour terms, and how we handle coordinated disclosure and CVE identifiers are all set out in the pgEdge Vulnerability Disclosure Statement: -**https://docs.pgedge.com/security** +[**https://docs.pgedge.com/security**](https://docs.pgedge.com/security) You may test this software freely in an environment you control. Testing pgEdge Cloud requires prior written authorisation — see the statement.