added security.md INFRAMARKETING-233

added security.md INFRAMARKETING-233

ref:1140dfa01e4364379cb153e9e0aab3e365ceabd6

1 files changed, 21 insertions, 0 deletions

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000000..e0086a4e3c
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,21 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+We're extremely grateful for security researchers and users who report vulnerabilities they discovered in YDB. All reports are thoroughly investigated.
+
+To report a potential vulnerability in YDB please email details to [security@ydb.tech](mailto:security@ydb.tech).
+
+### When Should I Report a Vulnerability?
+
+- You think you discovered a potential security vulnerability in YDB
+- You are unsure how a vulnerability affects YDB
+
+## Security Vulnerability Response
+
+Each report is acknowledged and analyzed by YDB maintainers within 5 working days.
+We will keep the reporter informed about the issue progress.
+
+## Public Disclosure Timing
+
+A public disclosure date is negotiated by YDB maintainers and the bug submitter. We prefer to fully disclose the bug as soon as possible once a mitigation is available for YDB users. It is reasonable to delay disclosure when the bug or the fix is not yet fully understood, the solution is not well-tested, or for vendor coordination. The timeframe for disclosure is from immediate (especially if it's already publicly known) to 90 days. For a vulnerability with a straightforward mitigation, we expect report date to disclosure date to be on the order of 7 days.