add security team

README.md

@@ -53,3 +53,7 @@ details on submitting patches and the contribution workflow.
 ## License
 
 Kurator is under the Apache 2.0 license. See the [LICENSE](LICENSE) file for details.
+
+## report a vulnerability
+
+If you find a vulnerability in Kurator, you can report it to our security-team in the [following way](https://github.com/kurator-dev/kurator/security-team/report-a-vulnerability.md). We will deal with it as soon as possible.

security-team/bug-report.md

@@ -0,0 +1,17 @@
+<!-- Please use this template while reporting a bug and provide as much info as possible. Not doing so may result in your bug not being addressed in a timely manner. Thanks!
+-->
+
+**What happened**:
+
+**What you expected to happen**:
+
+**How to reproduce it (as minimally and precisely as possible)**:
+
+**Anything else we need to know?**:
+
+**Environment**:
+
+- Kurator version:
+- kubectl version:
+- fluxcd version:
+- Others:

security-team/report-a-vulnerability.md

@@ -0,0 +1,20 @@
+## Report a Vulnerability
+
+We sincerely request you to keep the vulnerability information confidential and responsibly disclose the vulnerabilities.
+
+To report a vulnerability, please contact the [Security Team](security-groups.md). You can email the Security Team with the security details and the details expected for [kurator bug report](https://github.com/kurator-dev/kurator/security-team/bug-report.md).
+
+The team will help diagnose the severity of the issue and determine how to address the issue. The reporter(s) can expect a response within 2 business day acknowledging the issue was received. If a response is not received within 2 business day, please reach out to any Security Team member (listed [here](security-groups.md), under the `The Security Team` section) directly to confirm receipt of the issue. We’ll try to keep you informed about our progress throughout the process.
+
+### When Should I Report a Vulnerability?
+
+- You think you discovered a potential security vulnerability in Kurator
+- You are unsure how a vulnerability affects Kurator
+
+### When Should I NOT Report a Vulnerability?
+
+- You need help tuning Kurator components for security
+- You need help applying security related updates
+- Your issue is not security related
+
+If you think you discovered a vulnerability in another project that Kurator depends on, and that project has their own vulnerability reporting and disclosure process, please report it directly there.

security-team/security-groups.md

@@ -0,0 +1,11 @@
+## The Security Team
+
+Owners:
+
+- [xuzhonghu@huawei.com](mailto:xuzhonghu@huawei.com)
+
+Members:
+
+- [xuzhonghu@huawei.com](mailto:xuzhonghu@huawei.com)
+- [xieqianglong@huawei.com](mailto:xieqianglong@huawei.com)
+- [lizhencheng6@huawei.com](mailto:lizhencheng6@huawei.com)