fix: add security team details (#75)

* fix: add security team details

Signed-off-by: Terry Howe <[email protected]>

* Add not about secuirty mailing list

Signed-off-by: Terry Howe <[email protected]>

* Update SECURITY.md

Co-authored-by: Feynman Zhou <[email protected]>
Signed-off-by: Terry Howe <[email protected]>

---------

Signed-off-by: Terry Howe <[email protected]>
Co-authored-by: Feynman Zhou <[email protected]>

Author: TerryHowe

SECURITY.md

@@ -1,3 +1,40 @@
 # Security Policy
 
 Please follow the [security policy](https://oras.land/docs/community/reporting_security_concerns) to report a security vulnerability or concern.
+
+## Security Mailing List
+
+The ORAS project maintains a security mailing list at https://lists.cncf.io/g/cncf-oras-security for security-related discussions. This mailing list is intended for:
+
+* Coordination among security team members when handling vulnerability reports
+* Discussion of security best practices and improvements to ORAS security posture
+* Private communication regarding security concerns that are not yet ready for public disclosure
+* Coordination of security patches and disclosure timelines
+
+To report a vulnerability via email, send to: [[email protected]](mailto:[email protected])
+
+## Security Team
+
+The security team is made up of a subset of the ORAS project maintainers who are willing and able to respond to vulnerability reports.
+
+### Responsibilities
+
+* Members MUST be active project maintainers on active (non-deprecated) ORAS projects as defined in [the governance](governance/GOVERNANCE.md)
+* Members SHOULD engage in each reported vulnerability, at a minimum to make sure it is being handled
+* Members MUST keep the vulnerability details private and only share on a need to know basis
+
+### Membership
+
+New members are required to be active maintainers of ORAS projects who are willing to perform the responsibilities outlined above. The security team is a subset of the maintainers. Members can step down at any time and may join at any time.
+
+From time to time, ORAS projects are deprecated. If at any time a security team member is found to be no longer be an active maintainer on active ORAS projects, this individual will be removed from the security team.
+
+## Patch and Release Team
+
+When a vulnerability comes in and is acknowledged, a team - including maintainers of the ORAS project affected - will assembled to patch the vulnerability, release an update, and publish the vulnerability disclosure. This may expand beyond the security team as needed but will stay within the pool of ORAS project maintainers.
+
+## Disclosures
+
+Vulnerability disclosures are published on the security advisory in each repository. The disclosures will contain an overview, details about the vulnerability, a fix for the vulnerability that will typically be an update, and optionally a workaround if one is available.
+
+Disclosures will be published on the same day as a release fixing the vulnerability after the release is published.