feat(KONFLUX-15176): add SECURITY.md for CRA

[nmars]

Summary

• Add SECURITY.md to comply with CRA (EU Cyber Resilience Act) requirements.

Jira: KONFLUX-15176

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: df9ad5ad-3c6a-4f59-b160-b65e16884172

📥 Commits

Reviewing files that changed from the base of the PR and between 613785e and f59b6c9.

📒 Files selected for processing (1)

• SECURITY.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Added SECURITY.md with instructions for reporting Conforma security vulnerabilities or incidents through the linked security policy.

Changes

Security Policy

Layer / File(s)	Summary
Security reporting instructions SECURITY.md	Adds instructions for reporting security vulnerabilities or incidents and links to the Conforma security policy.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to f59b6

The PR adds SECURITY.md with publicly reachable security reporting instructions and does not change product behavior; no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the addition of SECURITY.md for CRA compliance and includes the related ticket.
Description check	✅ Passed	The description states what changed, explains the CRA compliance purpose, and links the related Jira ticket. It uses different headings from the template but includes the required information.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-for-conforma]

PR Summary by Qodo

Add CRA-compliant security reporting guidance

📝 Documentation 🕐 Less than 5 minutes

AI Description

• Adds a repository security policy entry point for CRA compliance.
• Directs vulnerability and incident reports to centralized Conforma guidance.

High-Level Assessment

Referencing the organization-wide security policy is the appropriate approach because it provides a discoverable repository entry point while keeping reporting instructions centralized and consistent.

Files changed (1) +5 / -0

Documentation (1) +5 / -0

SECURITY.mdAdd centralized security reporting guidance +5/-0

Add centralized security reporting guidance

• Adds a repository-level security policy that directs vulnerability and incident reporters to the shared Conforma security instructions, supporting CRA compliance.

SECURITY.md

[qodo-for-conforma]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can start a comment with 'qodo' or '@qodo' to chat about any finding

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 5:41 PM UTC · Completed 5:49 PM UTC

Commit: 87c4a29 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.06

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
unit-tests	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[fullsend-ai-review]

Looks good to me