From f59c3b8e1a923781efb2d5d3ce331ad073f3a4aa Mon Sep 17 00:00:00 2001
From: kploesser <18586836+kploesser@users.noreply.github.com>
Date: Fri, 2 Oct 2026 16:42:24 -0700
Subject: [PATCH] Add security policy

Add a SECURITY.md pointing security reports to the AWS Vulnerability
Disclosure Program (HackerOne / aws-security@amazon.com) rather than public
GitHub issues, so the repository's Security tab surfaces a reporting policy.
Matches the standard aws-samples reporting boilerplate.
---
 SECURITY.md | 11 +++++++++++
 1 file changed, 11 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..3cb5660
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,11 @@
+## Reporting Security Issues
+
+Amazon Web Services (AWS) is dedicated to the responsible disclosure of security vulnerabilities.
+
+We kindly ask that you **do not** open a public GitHub issue to report security concerns.
+
+Instead, please submit the issue to the AWS Vulnerability Disclosure Program via [HackerOne](https://hackerone.com/aws_vdp) or send your report via [email](mailto:aws-security@amazon.com).
+
+For more details, visit the [AWS Vulnerability Reporting Page](http://aws.amazon.com/security/vulnerability-reporting/).
+
+Thank you in advance for collaborating with us to help protect our customers.