feat(KONFLUX-15176): add SECURITY.md for CRA

[nmars]

Summary

• Add SECURITY.md to comply with CRA (EU Cyber Resilience Act) requirements.

Jira: KONFLUX-15176

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 97c8cff3-fcb4-475a-98a1-42ec724c92bf

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Add CRA-compliant security reporting guidance

📝 Documentation 🕐 Less than 5 minutes

AI Description

• Add a repository security policy to support Cyber Resilience Act compliance.
• Direct vulnerability and incident reports to Conforma’s centralized security instructions.

High-Level Assessment

Linking to Conforma’s centralized security policy is the appropriate approach because it provides one maintained source of truth and avoids duplicating reporting instructions across repositories.

Files changed (1) +5 / -0

Documentation (1) +5 / -0

SECURITY.mdAdd centralized security reporting policy +5/-0

Add centralized security reporting policy

• Adds repository-level guidance for reporting Conforma security vulnerabilities or incidents. The document directs reporters to the organization’s centrally maintained security policy.

SECURITY.md

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can start a comment with 'qodo' or '@qodo' to chat about any finding

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
unit-tests	0.96% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.