From 7b481b4bcd732c74c9cedc389872e229070d5843 Mon Sep 17 00:00:00 2001
From: vkartk <53650724+vkartk@users.noreply.github.com>
Date: Thu, 29 Oct 2026 00:19:34 +0530
Subject: [PATCH] docs: add security policy

Covers the supported workflow and caddy-base image versions, how OS fixes arrive and where to report.
---
 SECURITY.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..272f538
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,25 @@
+# Security Policy
+
+## Supported versions
+
+| What | Supported |
+|---|---|
+| Reusable workflows and scripts | The latest `v1.x` release, which the floating `v1` tag points to |
+| `ghcr.io/caddybuilds/caddy-base` image | `latest` and `alpine3.23` (the pinned Alpine release), rebuilt daily when Alpine is republished |
+
+Image repos should call the workflows at `@v1` to receive fixes without changing anything.
+
+## Image vulnerabilities
+
+The caddy-base image is Alpine plus the packages the official `caddy` image installs. OS
+fixes arrive when Alpine republishes the pinned tag; we don't pin or patch package versions.
+For vulnerabilities in the Caddy images built on it, see each image repo's security policy,
+for example [caddy-cloudflare](https://github.com/CaddyBuilds/caddy-cloudflare/security/policy).
+
+## Reporting a vulnerability
+
+- **In Alpine or one of its packages:** report it to [Alpine](https://security.alpinelinux.org/).
+- **In this repository** (the workflows, the check script, or the `Dockerfile`): report it
+  privately with **Report a vulnerability** on the
+  [Security tab](https://github.com/CaddyBuilds/caddy-base/security). Please don't open a
+  public issue.