From 3609e822ba912b893e3c97b09b195802651c8f19 Mon Sep 17 00:00:00 2001
From: Gerald Fruhmann <geraldfruhmann@gmail.com>
Date: Mon, 6 Jul 2026 14:21:28 +0200
Subject: [PATCH] chore: add SECURITY.md with vulnerability reporting policy

- Scope: CLI tool, credentials via env vars only, clients/ gitignored
- SDLC scanning table: bandit, ruff, Renovate, SBOM/Syft
- Private disclosure via GitHub Security tab
- 7-day acknowledge / 30-day fix SLA

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 SECURITY.md | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..0d8dbde
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,33 @@
+# Security Policy
+
+## Scope
+
+qms-kit is a CLI tool that deploys ISO 9001 QMS scaffolds into self-hosted
+(XWiki + Redmine) and cloud (Confluence + Jira) platforms.
+
+**Credentials never leave your machine** — all secrets (API tokens, passwords)
+are passed via environment variables and are never written to disk or logged.
+Client overlay configs in `config/clients/` are gitignored by design.
+
+## Security Scanning in the SDLC
+
+| Layer | Tool | Trigger |
+|-------|------|---------|
+| SAST (Python) | bandit | CI (every PR) |
+| Lint / code quality | ruff | CI (every PR) |
+| Dependency updates | Renovate | Automated PRs |
+| SBOM | Syft (CycloneDX) | On every `v*` release tag |
+
+## Reporting a Vulnerability
+
+Please **do not** open a public GitHub issue for security vulnerabilities.
+
+Instead: GitHub → Security → **"Report a vulnerability"** (private disclosure)
+or contact the repository owner directly.
+
+Response SLA:
+- **Acknowledgement:** within 7 days
+- **Fix or mitigation:** within 30 days for confirmed vulnerabilities
+
+No bug bounty programme — reports are handled promptly and credited in the
+release notes if desired.