docs: Revise security policy and reporting guidelines (#19886)

UlisesGascon · web-flow · commit 44cf16f2ebd1 · 2025-09-25T15:23:26.000+03:00
diff --git a/SECURITY.md b/SECURITY.md
@@ -1,20 +1,57 @@
-# Reporting Security Issues
+# Security Policy
 
-If you discover a security issue in webpack, please report it by sending an
-email to [webpack@opencollective.com](mailto:webpack@opencollective.com).
+## Reporting a Vulnerability
 
-This will allow us to assess the risk, and make a fix available before we add a
-bug report to the GitHub repository.
+Please report security issues **privately**:
 
-Thanks for helping make webpack safe for everyone.
+- Email: [webpack-security@openjsf.org](mailto:webpack-security@openjsf.org)
+
+**Do not** file public GitHub issues for security problems.
+
+When reporting, please include:
+
+- Affected project/repo and version(s)
+- Impact and component(s) involved
+- Reproduction steps or PoC (if available)
+- Your contact details and preferred credit name
+
+If you do not receive an acknowledgement of your report within **6 business days**, or if you cannot find a private security contact for the project, you may **escalate to the OpenJS Foundation CNA** at `security@lists.openjsf.org`.
+
+If the project acknowledges your report but does not provide any further response or engagement within **14 days**, escalation is also appropriate.
+
+## Coordination & Disclosure
+
+We follow coordinated vulnerability disclosure:
+
+- We will acknowledge your report, assess impact, and work on a fix.
+- We aim to provide status updates until resolution.
+- Once a fix or mitigation is available, we will publish a security advisory (and request a CVE via the OpenJS CNA when applicable).
+- Reporters are credited by default unless you request otherwise.
+
+---
+
+## Guidelines for Security Testing
+
+When investigating and reporting vulnerabilities, please **do not**:
+
+- Break the law
+- Access or modify data beyond what is needed to demonstrate the issue
+- Use high-intensity or destructive testing tools
+- Attempt denial of service (DoS) attacks
+- Social engineer, phish, or physically attack project members
+- Publicly disclose before we release a fix or advisory
+
+---
 
 ## Threat Model
 
 For an overview of the security assumptions, potential attack vectors, and areas
 of concern relevant to webpack, please refer to the
 [Threat Model](https://github.com/webpack/security-wg/blob/main/docs/threat-model.md).
 
-## Incident Response Plan
+---
+
+## Incident Response
 
-In the event of a security incident, please refer to the
+In the event of a broader security incident, please refer to our
 [Security Incident Response Plan](https://github.com/webpack/webpack/blob/main/INCIDENT_RESPONSE_PLAN.md).
