docs: guide security reports to GitHub advisories

SECURITY.md

@@ -2,40 +2,73 @@
 
 ## Supported Versions
 
-Currently being supported with security updates.
+We give security updates to these versions:
 
 | Version  | Supported          |
 | -------- | ------------------ |
 | >= 3.0.0 | :white_check_mark: |
 
-## Reporting a Vulnerability
+## Report a Vulnerability
 
-The cnpmcore OSS team and community take all security vulnerabilities seriously.
-Thank you for improving the security of our open source software.
-We appreciate your efforts and responsible disclosure and will make every effort to acknowledge your contributions.
+The cnpmcore team and the community give full attention to all security vulnerabilities.
+Thank you for your work to make our open source software more secure.
+We value your effort and your responsible disclosure.
+We will give you credit for your contribution.
 
-Report security vulnerabilities by emailing the cnpmcore security team at:
+**Do not report security vulnerabilities in public GitHub issues, discussions, or pull requests.**
+
+### Preferred: GitHub Security Advisories
+
+Send your report with GitHub private vulnerability reporting:
+
+https://github.com/cnpm/cnpmcore/security/advisories/new
+
+A private report has these advantages:
+
+- Only you and the maintainers can read the report.
+- All of the discussion stays in one place.
+- We can give you credit in the advisory when we publish it.
+- We can request a CVE when we release the fix.
+
+Give as much of this information as you can:
+
+- The type of the issue.
+- The version or the commit that has the issue.
+- The full path of each source file that relates to the issue.
+- The steps to reproduce the issue.
+- The proof-of-concept code or the exploit code, if you have it.
+- The impact of the issue.
+- The method that an attacker can use to exploit the issue.
+
+### Alternative: Email
+
+If you cannot use GitHub Security Advisories, send an email to the cnpmcore security team:
 
 ```
 fengmk2+cnpmcoresecurity@gmail.com
 killa07071201@gmail.com
+smith3816@gmail.com
+elrrrrrrr@gmail.com
 ```
 
-The lead maintainer will acknowledge your email within 48 hours,
-and will send a more detailed response within 72 hours indicating the next steps in handling your report.
-After the initial reply to your report,
-the security team will endeavor to keep you informed of the progress towards a fix and full announcement,
-and may ask for additional information or guidance.
+We will confirm that we received your report.
+We will process the report as soon as possible.
+We will then tell you the next steps.
+The security team will tell you about the progress of the fix and the announcement.
+The team can also ask you for more information.
 
-Report security vulnerabilities in third-party modules to the person or team maintaining the module.
+Report a vulnerability in a third-party module to the person or the team that maintains the module.
 
 ## Disclosure Policy
 
-When the security team receives a security bug report, they will assign it
-to a primary handler. This person will coordinate the fix and release
-process, involving the following steps:
+The security team assigns each report to a primary handler.
+The primary handler controls the fix and the release.
+The handler does these steps:
 
-- Confirm the problem and determine the affected versions.
-- Audit code to find any potential similar problems.
-- Prepare fixes for all releases still under maintenance. These fixes
-  will be released as fast as possible to NPM.
+- Confirm the problem.
+- Find the versions that have the problem.
+- Examine the code to find related problems.
+- Prepare a fix for each release that we maintain.
+- Release the fixes to NPM as soon as possible.
+- Publish a GitHub Security Advisory after we release the fix.
+  Give credit to the reporter, unless the reporter asks to stay anonymous.