Add Security policy page to main navigation bar

docs/security/00-index.md

@@ -0,0 +1,19 @@
+# Vulnerability Management and Incident Response Policy
+
+## 1. Reporting
+
+- Report security vulnerabilities via email to [osbuilders@redhat.com](mailto:osbuilders@redhat.com).
+- Do not open public issues or submit public pull requests for undisclosed security vulnerabilities.
+- Include a technical description, steps to reproduce, a proof of concept (if available), and the suspected impact.
+
+## 2. Triage and Response
+
+- The core maintainer team will acknowledge receipt of the vulnerability report within 72 hours.
+- The incident response team will assign a severity level during triage.
+- The reporter may receive status updates weekly through the email address used to report the vulnerability.
+
+## 3. Public Disclosure
+
+- Public disclosure occurs strictly after a patch is released and integrated into the primary branch.
+- A CVE identifier will be requested when appropriate.
+- The reporter will be credited in the public security advisory and release notes unless anonymity is explicitly requested.

docusaurus.config.ts

@@ -104,6 +104,12 @@ const config: Config = {
           position: 'left',
           label: 'Developer Guide',
         },
+        {
+          type: 'docSidebar',
+          sidebarId: 'security',
+          position: 'left',
+          label: 'Security',
+        },
         {
           href: 'https://github.com/osbuild/',
           label: 'GitHub',

sidebars.ts

@@ -27,6 +27,9 @@ const sidebars: SidebarsConfig = {
   developer: [
     {type: 'autogenerated', dirName: 'developer-guide'},
   ],
+  security: [
+    {type: 'autogenerated', dirName: 'security'},
+  ],
 
   // But you can create a sidebar manually
   /*