1 files changed, 76 insertions, 0 deletions
diff --git a/docs/en/security.rst b/docs/en/security.rst
new file mode 100644
index 00000000..7643d0ca
--- /dev/null
+++ b/docs/en/security.rst
@@ -0,0 +1,76 @@
+Security Advisories and CVE Catalog
+===================================
+
+Report a vulnerability
+----------------------
+
+Please follow the repository's
+`security policy <https://github.com/cherry-embedded/CherryUSB/security/policy>`_
+or email ``[email protected]``.
+
+Published advisories
+--------------------
+
+The authoritative GitHub advisory list is available at
+`CherryUSB Security Advisories <https://github.com/cherry-embedded/CherryUSB/security/advisories>`_.
+
+No entries have been added to this catalog yet. This does not imply that no
+vulnerabilities or external advisories exist. Add entries only after the
+maintainers have confirmed the issue and approved public disclosure.
+
+Information required for each entry
+-----------------------------------
+
+* Advisory title and publication date.
+* GHSA identifier and public advisory URL, if assigned.
+* CVE identifier, if assigned; an advisory may be published without a CVE.
+* Affected releases or commits and any required build configuration.
+* Fixed releases and full fix commit identifiers.
+* Affected host/device classes and controller drivers, where applicable.
+* Impact, trigger conditions, and available workarounds.
+* CWE and CVSS version/vector/score, if assessed.
+* Reporter attribution, with the reporter's consent.
+
+Do not infer an affected version range from the fix commit alone, invent CVE
+identifiers, or treat an internal code review finding as a published advisory.
+
+CVE advisory template
+---------------------
+
+This is a template, not a published advisory. Replace ``xxxx`` with confirmed information.
+
+CVE-xxxx-xxxx: xxxx
+~~~~~~~~~~~~~~~~~~~
+
+:Publication date: xxxx
+:CVE ID: CVE-xxxx-xxxx
+:GHSA ID: GHSA-xxxx-xxxx-xxxx
+:Severity: xxxx
+:CWE: CWE-xxxx
+:CVSS version, vector, and score: xxxx
+:Affected versions: xxxx
+:Fixed versions: xxxx
+:Fix commit: xxxx
+:Affected components: xxxx
+:Advisory URL: xxxx
+:Reporter: xxxx
+
+**Description**
+
+xxxx
+
+**Impact and trigger conditions**
+
+xxxx
+
+**Fix**
+
+xxxx
+
+**Workarounds**
+
+xxxx
+
+**References**
+
+* xxxx