docs: switch security reporting to GitHub private vulnerability reporting

[Vad1mo]

Implements the intake-channel change from goharbor/community#292: replace the cncf-harbor-security@lists.cncf.io mailing list with GitHub private vulnerability reporting as the channel for reporting security vulnerabilities. Private vulnerability reporting is already enabled on this repository.

Changes

• SECURITY.md
  • Reporters are directed to the Security tab / Report a vulnerability form instead of the mailing list. This is the sole intake channel, per the proposal; the GitHub-account requirement is stated explicitly rather than left implicit.
  • The response SLA is split: reports are acknowledged within 5 business days, and the investigation and follow-up plan are no longer bound to the old 3-business-day promise.
  • The Patch, Release, and Disclosure section now describes the advisory workflow: accepted reports become draft advisories with the reporter as collaborator, CVSS is scored with the built-in calculator, the CVE is requested in-band from GitHub, and the fix is developed in a temporary private fork under embargo.
  • The in-band CVE request is scoped to cases where GitHub is eligible to act as CNA; where another CNA already covers the affected component, the Security Team coordinates with that CNA instead of filing a duplicate.
  • The mailing list is retained only for distributors-list administration (membership requests, embargo-breach reports), which the Embargo Policy and Membership sections still reference. It is explicitly not a vulnerability intake channel.
  • Distributor coordination (cncf-harbor-distributors-announce), the embargo policy, and disclosure timing are unchanged, per the proposal's non-goals.
• README.md: the Reporting security vulnerabilities section pointed at the mailing list and promised email follow-ups. It now routes to the advisory form.
• .github/ISSUE_TEMPLATE/config.yml (new): contact link on the issue chooser routing vulnerability reports to the private advisory form. blank_issues_enabled: false so reports cannot bypass the chooser and its security link.
• .github/ISSUE_TEMPLATE/bug_report.md: warning at the top telling reporters not to file security vulnerabilities as public issues.

Review feedback addressed

• @stonezdj — the 3-business-day promise of a full investigation plan was unrealistic. Acknowledgement is now a 5-business-day commitment, decoupled from the investigation.
• Copilot — CVE requests no longer bypass another CNA covering the component; README.md no longer points at the mailing list; the mailing list is listed again under Mailing lists, correctly scoped; reporter visibility wording and template grammar were fixed earlier.

Related

• Proposal: Proposal: Switch security reporting to GitHub private vulnerability reporting community#292

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.59%. Comparing base (c9e825a) to head (3b82772).
⚠️ Report is 36 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #23559      +/-   ##
==========================================
+ Coverage   66.36%   66.59%   +0.23%     
==========================================
  Files        1073     1080       +7     
  Lines      117716   118628     +912     
  Branches     2965     2992      +27     
==========================================
+ Hits        78120    79001     +881     
+ Misses      35292    35267      -25     
- Partials     4304     4360      +56     

Flag	Coverage Δ
unittests	66.59% <ø> (+0.23%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.
see 61 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[wy65701436]

lgtm

[Copilot]

Pull request overview

Updates Harbor’s security disclosure documentation and GitHub issue intake to route vulnerability reports through GitHub Private Vulnerability Reporting, aligning the repo’s public guidance with the advisory-based workflow.

Changes:

• Updates SECURITY.md to direct reporters to GitHub private vulnerability reporting and describe the advisory-driven embargo workflow.
• Adds an issue chooser contact_links entry to route security reports away from public issues.
• Adds a prominent warning to the bug report template to prevent public filing of vulnerabilities.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
SECURITY.md	Switches primary reporting channel to GitHub private vulnerability reporting and updates the disclosure workflow narrative.
.github/ISSUE_TEMPLATE/config.yml	Adds an issue chooser contact link for private vulnerability reporting.
.github/ISSUE_TEMPLATE/bug_report.md	Adds a top-of-template warning to redirect security reports to the private advisory form.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

SECURITY.md:14

• The PR says the mailing list remains a fallback for reporters without a GitHub account, but this section only states that an account is required and gives those reporters no reporting path. Please document the promised fallback here so accountless reporters are not blocked from private disclosure.

To report a vulnerability or a security-related issue, use [GitHub private vulnerability reporting](https://github.com/goharbor/harbor/security/advisories/new): open the [Security tab](https://github.com/goharbor/harbor/security) of the affected repository and click **Report a vulnerability**. The report is visible only to you and the Harbor Security Team, which is made up of Harbor maintainers who have committer and release permissions. Reports will be addressed within 3 business days, including a detailed plan to investigate the issue and any potential workarounds to perform in the meantime. Do not report non-security-impacting bugs through this channel. Use [GitHub issues](https://github.com/goharbor/harbor/issues/new/choose) instead. Note that filing a report requires a GitHub account.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (1)

SECURITY.md:16

• GitHub does not grant access to private vulnerability reports based on committer or release permissions. Proposed reports are visible to repository/organization owners, security managers, and repository admins, while users with write/committer access alone cannot view them. Describing visibility in terms of the Security Team's committer permissions therefore misstates the new channel's confidentiality and access model.

The report is visible only to you and the Harbor Security Team, which is made up of Harbor maintainers who have committer and release permissions. Reports will be acknowledged within 5 business days. The Harbor Security Team will then investigate and follow up with a plan to address the issue and any potential workarounds to perform in the meantime.