From c7858affb4839bc8f8f203880ddacd36e3c0d91c Mon Sep 17 00:00:00 2001
From: Benjamin Wagner <72468969+benjiwagner@users.noreply.github.com>
Date: Mon, 20 Jul 2026 09:58:27 +0200
Subject: [PATCH] docs(security): add organization security policy

---
 SECURITY.md | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..83bbe99
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,11 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Please report suspected vulnerabilities privately through GitHub's private vulnerability reporting on the affected repository (Security tab, "Report a vulnerability"). Do not open public issues or pull requests for security reports.
+
+We aim to acknowledge reports within 72 hours. Please include reproduction steps, affected versions or commits, and impact.
+
+## Scope
+
+This policy covers all repositories in the customermates organization, including the Customermates product and the n8n community integration. Secrets exposed in any repository should also be reported through the same private channel.