Minimal SECURITY.md which is expected in github repos

[schneidergithub]

A simple security policy, since I'm sure the owners of the repo will want to update this.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• Consider clarifying the scope of this policy (e.g., which projects or components are covered) so reporters know whether this contact applies to their finding.
• It would be helpful to include expected response timelines or what reporters can generally expect after contacting security@docker.com (acknowledgment, triage, etc.).
• If there are preferred formats or details for vulnerability reports (e.g., steps to reproduce, impact assessment), mentioning them here can improve report quality and reduce back-and-forth.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider clarifying the scope of this policy (e.g., which projects or components are covered) so reporters know whether this contact applies to their finding.
- It would be helpful to include expected response timelines or what reporters can generally expect after contacting security@docker.com (acknowledgment, triage, etc.).
- If there are preferred formats or details for vulnerability reports (e.g., steps to reproduce, impact assessment), mentioning them here can improve report quality and reduce back-and-forth.

## Individual Comments

### Comment 1
<location path="SECURITY.md" line_range="5" />
<code_context>
+
+## Reporting a Vulnerability
+
+Do not report vulnerabilities publicly, please contact security@docker.com 
</code_context>
<issue_to_address>
**suggestion (typo):** Consider fixing the comma splice and adding proper sentence-ending punctuation.

This sentence joins two independent clauses with only a comma. Consider either: "Do not report vulnerabilities publicly. Please contact security@docker.com." or "Do not report vulnerabilities publicly; please contact security@docker.com."
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[gemini-code-assist]

Code Review

This pull request introduces a SECURITY.md file to establish a security policy, providing instructions for reporting vulnerabilities privately via email. I have no feedback to provide.

[schneidergithub]

@ericcurtin - I'm curious why this was closed? There is no security.md file, and at a bare minimum an email address would be useful to know, so people (like me) can submit security reports responsibly. I imagine a likely scenario is someone posting publicly a vulnerability in the repo's issues.