Validate process to report security issues

[nimbinatus]

Clearly defined and discoverable process to report security issues.

Should be a link to a section in the security docs, iirc.

[mohan-shash]

bootc meets both CNCF security documentation requirements:

1. Clearly defined and discoverable process to report security issues:

• SECURITY.md provides step-by-step instructions for GitHub Security Advisories
• Clear guidance on what NOT to do (no public disclosure)
• Root-level location (discoverable)
• Reference: https://github.com/bootc-dev/bootc/blob/main/SECURITY.md

2. Document assignment of security response roles and how reports are handled:

• GOVERNANCE.md defines Security Response Team
• Appointment process: Maintainers appoint minimum 2 contributors
• Annual review requirement
• Clear responsibility: "handle all reports according to security policy"
• Reference: https://github.com/bootc-dev/bootc/blob/main/GOVERNANCE.md#security-response-team

Comparison with CNCF Graduated Projects:

• Uses same reporting method as containerd (GitHub Security Advisories)
• Better cross-referencing than Kubernetes (external docs) or containerd (separate repo)
• Appropriate depth for incubation stage

Both requirements fully met. ✅