From 6edc3f705694f6b7d6a2a3c71cb38f78d49a2a91 Mon Sep 17 00:00:00 2001
From: Joseph Gette <joseph.gette@datadoghq.com>
Date: Tue, 3 Nov 2026 10:52:27 +0100
Subject: [PATCH] Add SECURITY.md with a private vulnerability reporting
 channel

Datadog's open source security review recommends a disclosure policy so
reporters use security@datadoghq.com instead of public issues.
---
 SECURITY.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..81a913e
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,12 @@
+# Security Policy
+
+## Supported Versions
+
+Conduit is pre-1.0. Security fixes go into the latest release only.
+
+## Reporting a Vulnerability
+
+If you have found a security issue in conduit, please contact the security team at
+security@datadoghq.com, rather than filing a public issue.
+
+Include the conduit version (`conduit --version`), the Bazel version, and steps to reproduce.