docs: add security md

Signed-off-by: sakumisu <[email protected]>

4 files changed, 163 insertions, 0 deletions

diff --git a/docs/en/index.rst b/docs/en/index.rst
index 98a74c61..f33ca558 100755
--- a/docs/en/index.rst
+++ b/docs/en/index.rst
@@ -157,3 +157,9 @@ Considering USB performance requirements to reach theoretical USB hardware bandw
    :caption: Commercial Support
 
    support/index
+
+.. toctree::
+   :maxdepth: 1
+   :caption: Security
+
+   security
diff --git a/docs/en/security.rst b/docs/en/security.rst
new file mode 100644
index 00000000..7643d0ca
--- /dev/null
+++ b/docs/en/security.rst
@@ -0,0 +1,76 @@
+Security Advisories and CVE Catalog
+===================================
+
+Report a vulnerability
+----------------------
+
+Please follow the repository's
+`security policy <https://github.com/cherry-embedded/CherryUSB/security/policy>`_
+or email ``[email protected]``.
+
+Published advisories
+--------------------
+
+The authoritative GitHub advisory list is available at
+`CherryUSB Security Advisories <https://github.com/cherry-embedded/CherryUSB/security/advisories>`_.
+
+No entries have been added to this catalog yet. This does not imply that no
+vulnerabilities or external advisories exist. Add entries only after the
+maintainers have confirmed the issue and approved public disclosure.
+
+Information required for each entry
+-----------------------------------
+
+* Advisory title and publication date.
+* GHSA identifier and public advisory URL, if assigned.
+* CVE identifier, if assigned; an advisory may be published without a CVE.
+* Affected releases or commits and any required build configuration.
+* Fixed releases and full fix commit identifiers.
+* Affected host/device classes and controller drivers, where applicable.
+* Impact, trigger conditions, and available workarounds.
+* CWE and CVSS version/vector/score, if assessed.
+* Reporter attribution, with the reporter's consent.
+
+Do not infer an affected version range from the fix commit alone, invent CVE
+identifiers, or treat an internal code review finding as a published advisory.
+
+CVE advisory template
+---------------------
+
+This is a template, not a published advisory. Replace ``xxxx`` with confirmed information.
+
+CVE-xxxx-xxxx: xxxx
+~~~~~~~~~~~~~~~~~~~
+
+:Publication date: xxxx
+:CVE ID: CVE-xxxx-xxxx
+:GHSA ID: GHSA-xxxx-xxxx-xxxx
+:Severity: xxxx
+:CWE: CWE-xxxx
+:CVSS version, vector, and score: xxxx
+:Affected versions: xxxx
+:Fixed versions: xxxx
+:Fix commit: xxxx
+:Affected components: xxxx
+:Advisory URL: xxxx
+:Reporter: xxxx
+
+**Description**
+
+xxxx
+
+**Impact and trigger conditions**
+
+xxxx
+
+**Fix**
+
+xxxx
+
+**Workarounds**
+
+xxxx
+
+**References**
+
+* xxxx
diff --git a/docs/zh/index.rst b/docs/zh/index.rst
index 6e3b2f4a..da390c50 100644
--- a/docs/zh/index.rst
+++ b/docs/zh/index.rst
@@ -158,3 +158,9 @@ CherryUSB 是一个小而美的、可移植性高的、用于嵌入式系统的
    :caption: 商业支持
 
    support/index
+
+.. toctree::
+   :maxdepth: 1
+   :caption: 安全公告
+
+   security
diff --git a/docs/zh/security.rst b/docs/zh/security.rst
new file mode 100644
index 00000000..0c728d46
--- /dev/null
+++ b/docs/zh/security.rst
@@ -0,0 +1,75 @@
+安全公告与 CVE 目录
+===================
+
+报告安全漏洞
+------------
+
+请按照仓库的
+`安全策略 <https://github.com/cherry-embedded/CherryUSB/security/policy>`_
+提交报告，或发送邮件至 ``[email protected]``。
+
+已公开的安全公告
+----------------
+
+GitHub 上的正式公告请查看
+`CherryUSB Security Advisories <https://github.com/cherry-embedded/CherryUSB/security/advisories>`_。
+
+本目录目前尚未添加公告条目。这不代表不存在漏洞或外部公告。
+仅在维护者确认问题并决定公开披露后，才将对应条目加入本目录。
+
+每条公告需要的信息
+------------------
+
+* 公告标题和发布日期。
+* GHSA 编号及公开公告链接（如已分配）。
+* CVE 编号（如已分配）；公告也可以不包含 CVE 编号。
+* 受影响的版本或提交，以及必要的构建配置。
+* 修复版本和完整的修复提交编号。
+* 涉及的主机/设备类和控制器驱动（如适用）。
+* 影响、触发条件，以及可用的缓解措施。
+* CWE，以及 CVSS 版本、向量和评分（如已评估）。
+* 经报告者同意的署名。
+
+不要仅依据修复提交推断受影响的版本范围，不要编造 CVE 编号，
+也不要将内部代码审查发现直接视为已公开的安全公告。
+
+CVE 公告模板
+------------
+
+以下为待填写模板，不是已公开的漏洞公告。请将 ``xxxx`` 替换为已确认的信息。
+
+CVE-xxxx-xxxx：xxxx
+~~~~~~~~~~~~~~~~~~~
+
+:发布日期: xxxx
+:CVE 编号: CVE-xxxx-xxxx
+:GHSA 编号: GHSA-xxxx-xxxx-xxxx
+:严重程度: xxxx
+:CWE: CWE-xxxx
+:CVSS 版本、向量及评分: xxxx
+:受影响版本: xxxx
+:修复版本: xxxx
+:修复提交: xxxx
+:涉及组件: xxxx
+:公告链接: xxxx
+:报告者: xxxx
+
+**漏洞描述**
+
+xxxx
+
+**影响与触发条件**
+
+xxxx
+
+**修复说明**
+
+xxxx
+
+**缓解措施**
+
+xxxx
+
+**参考链接**
+
+* xxxx