Merge pull request #574 from c3y1huang/where-report-security-issues

Where to report security issues

README.md

@@ -64,5 +64,9 @@ Finally, the location of the config file can be changed either through the cli a
 
 ## FAQ
 
-- [How is the different from RKE1 or K3s?](https://docs.rke2.io/#how-is-this-different-from-rke-or-k3s)
+- [How is this different from RKE1 or K3s?](https://docs.rke2.io/#how-is-this-different-from-rke-or-k3s)
 - [Why two names?](https://docs.rke2.io/#why-two-names)
+
+## Security
+
+Security issues in RKE2 can be reported by sending an email to [[email protected]](mailto:[email protected]). Please do not open security issues here.

docs/index.md

@@ -27,3 +27,9 @@ It is known as RKE Government in order to convey the primary use cases and secto
 It is known as RKE2 because it is the future of the RKE distribution. Right now, it is entirely independent from RKE1, but our next phase of development will focus on a seamless upgrade path and feature parity with RKE1 when integrated with the Rancher multi-cluster management platform.
 
 Once we've completed the upgrade path and Rancher-integration feature parity work, RKE1 and RKE Government will converge into a single distribution.
+
+## Security
+
+Rancher Labs supports responsible disclosure and endeavors to resolve security
+issues in a reasonable timeframe. To report a security vulnerability, email
+[[email protected]](mailto:[email protected]).