Revise SECURITY.md for vulnerability reporting

SECURITY.md

@@ -1,94 +1,30 @@
-# Notices for Eclipse Thingweb
+# Security Policy
 
-This content is produced and maintained by the Eclipse Thingweb project.
+This Eclipse Foundation Project adheres to the [Eclipse Foundation Vulnerability Reporting Policy](https://www.eclipse.org/security/policy/).
 
--   Project home: https://projects.eclipse.org/projects/iot.thingweb
+## How To Report a Vulnerability
 
-## Trademarks
+If you think you have found a vulnerability in this repository, please report it to us through coordinated disclosure.
 
-Eclipse Thingweb is a trademark of the Eclipse Foundation.
+**Please do not report security vulnerabilities through public issues, discussions, or change requests.**
 
-## Copyright
+Instead, report it using one of the following ways:
 
-All content is the property of the respective authors or their employers. For
-more information regarding authorship of content, please consult the listed
-source code repository logs.
+-   Create a [confidential issue](https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/new?issuable_template=new_vulnerability) in the Eclipse Foundation Vulnerability Reporting Tracker
+-   Report a [vulnerability](https://github.com/eclipse-thingweb/website/security/advisories/new) directly via private vulnerability reporting on GitHub
 
-Note: The {year} in the copyright statements is the year in which the content
-was created (e.g. “2004”). A range of years is not used.
+You can find more information about reporting and disclosure at the [Eclipse Foundation Security page](https://www.eclipse.org/security/).
 
-## Declared Project Licenses
+Please include as much of the information listed below as you can to help us better understand and resolve the issue:
 
-This program and the accompanying materials are made available under the terms
-of the Eclipse Public License v. 2.0 which is available at
-http://www.eclipse.org/legal/epl-2.0, or the W3C Software Notice and Document
-License (2015-05-13) which is available at
-https://www.w3.org/Consortium/Legal/2015/copyright-software-and-document.
+-   The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting)
+-   Affected version(s)
+-   Impact of the issue, including how an attacker might exploit the issue
+-   Step-by-step instructions to reproduce the issue
+-   The location of the affected source code (tag/branch/commit or direct URL)
+-   Full paths of source file(s) related to the manifestation of the issue
+-   Configuration required to reproduce the issue
+-   Log files that are related to this issue (if possible)
+-   Proof-of-concept or exploit code (if possible)
 
-SPDX-License-Identifier: EPL-2.0 OR W3C-20150513
-
-## Source Code
-
-The project maintains the following source code repositories:
-
-## Third-party Content
-
-## Cryptography
-
-Content may contain encryption software. The country in which you are currently
-may have restrictions on the import, possession, and use, and/or re-export to
-another country, of encryption software. BEFORE using any encryption software,
-please check the country's laws, regulations and policies concerning the import,
-possession, or use, and re-export of encryption software, to see if this is
-permitted.
-
-<!--- https://www.eclipse.org/security/ --->
-
-_ISO 27005 defines vulnerability as:
-"A weakness of an asset or group of assets that can be exploited by one or more threats."_
-
-## The Eclipse Security Team
-
-The Eclipse Security Team provides help and advice to Eclipse projects
-on vulnerability issues and is the first point of contact
-for handling security vulnerabilities.
-Members of the Security Team are committers on Eclipse Projects
-and members of the Eclipse Architecture Council.
-
-Contact the [Eclipse Security Team](mailto:security@eclipse.org).
-
-**Note that, as a matter of policy, the security team does not open attachments.**
-
-## Reporting a Security Vulnerability
-
-Vulnerabilities can be reported either via email to the Eclipse Security Team
-or directly with a project via the Eclipse Foundation's Bugzilla instance.
-
-The general security mailing list address is security@eclipse.org.
-Members of the Eclipse Security Team will receive messages sent to this address.
-This address should be used only for reporting undisclosed vulnerabilities;
-regular issue reports and questions unrelated to vulnerabilities in Eclipse software
-will be ignored.
-Note that this email address is not encrypted.
-
-The community is also encouraged to report vulnerabilities using the
-[Eclipse Foundation's Bugzilla instance](https://bugs.eclipse.org/bugs/enter_bug.cgi?product=Community&component=Vulnerability%20Reports&keywords=security&groups=Security_Advisories).
-Note that you will require an Eclipse Foundation account to create an issue report,
-but by doing so you will be able to participate directly in the resolution of the issue.
-
-Issue reports related to vulnerabilities must be marked as "committers-only",
-either automatically by clicking the provided link, by the reporter,
-or by a committer during the triage process.
-Note that issues marked "committers-only" are visible to all Eclipse committers.
-By default, a "committers-only" issue is also accessible to the reporter
-and individuals explicitly indicated in the "cc" list.
-
-## Disclosure
-
-Disclosure is initially limited to the reporter and all Eclipse Committers,
-but is expanded to include other individuals, and the general public.
-The timing and manner of disclosure is governed by the
-[Eclipse Security Policy](https://www.eclipse.org/security/policy.php).
-
-Publicly disclosed issues are listed on the
-[Disclosed Vulnerabilities Page](https://www.eclipse.org/security/known.php).
+This information will help us triage your report more quickly.