Publish durable private security reporting and response targets

[cervantesh]

Maturity context

• Project maturity: developing (51/100)
• Dimension: security_configuration
• Priority: high

Evidence

• SECURITY.md falls back to a minimal public issue when private reporting is unavailable
• Private vulnerability reporting is disabled on T50-Systems/.github
• Security response timing is only described as as soon as practical

Scope

• Enable private vulnerability reporting where supported or publish a monitored security email/form as the durable fallback.
• Define acknowledgement, triage, remediation-update, and coordinated-disclosure targets by severity.
• Name the supported-version default and repository-specific override mechanism.
• Ensure issue-form and SUPPORT guidance route reporters to the same private channel.

Acceptance criteria

• A reporter can reach a private channel without first creating a public issue.
• SECURITY.md states measurable acknowledgement and status-update targets.
• The Security report contact link resolves to the documented private-reporting path.
• Root and default-location security policy copies remain consistent under CI.

Help wanted

Policy drafting is help-wanted, but organization owners must approve the monitored disclosure channel and response commitments.

---

Generated from the repository maturity assessment dated 2026-07-11. Do not include credentials, customer data, or local-only files in public discussion.

[cervantesh]

Completed by PR #9. The merged governance change adds portable issue forms, private security reporting and response targets, CODEOWNERS/continuity policy, read-only adoption auditing, a maintained public project directory, and documented inheritance/override verification.