abcd's vulnerability-reporting policy is below SOTA (ISO/IEC 29147, CERT/CC coordinated disclosure, disclose.io). SECURITY.md covers the reporting channel, a one-week acknowledgement, scope and supported versions, but lacks: (1) a coordinated-disclosure timeline / embargo window (e.g. fix-within-N-days, public disclosure after fix or 90 days); (2) a safe-harbor clause for good-faith research; (3) the credit policy decided 2026-08-27 (opt-in GHSA credits field / Reported-by on public issues / never ACKNOWLEDGEMENTS). And the repo publishes no security.txt (RFC 9116, /.well-known/security.txt), the machine-readable 'where to report' pointer. Fix (docs-only): extend SECURITY.md with the timeline, safe harbor and credit policy, and add a served security.txt. Maps to the reporting side of the 2026-08-27 security-advisory-handling pilot (ISO 29147); the handling side maps to ISO 30111 and graduates to the automation intent.

abcd's vulnerability-reporting policy is below SOTA (ISO/IEC 29147, CERT/CC coordinated disclosure, disclose.io). SECURITY.md covers the reporting channel, a one-week acknowledgement, scope and supported versions, but lacks: (1) a coordinated-disclosure timeline / embargo window (e.g. fix-within-N-days, public disclosure after fix or 90 days); (2) a safe-harbor clause for good-faith research; (3) the credit policy decided 2026-08-27 (opt-in GHSA credits field / Reported-by on public issues / never ACKNOWLEDGEMENTS). And the repo publishes no security.txt (RFC 9116, /.well-known/security.txt), the machine-readable 'where to report' pointer. Fix (docs-only): extend SECURITY.md with the timeline, safe harbor and credit policy, and add a served security.txt. Maps to the reporting side of the 2026-08-27 security-advisory-handling pilot (ISO 29147); the handling side maps to ISO 30111 and graduates to the automation intent.

Remedy grounds (2026-09-29)

• RFC 9116 makes Contact and Expires mandatory, fixes the path at /.well-known/security.txt and recommends Expires under a year out: https://www.rfc-editor.org/rfc/rfc9116 (consulted 2026-09-29), hence a gate on staleness. Project Zero's 90+30 policy: https://projectzero.google/vulnerability-disclosure-policy.html; disclose.io publishes public-domain safe-harbour terms and a policy generator: https://disclose.io/ (both consulted 2026-09-29).
• The timeline and whether the file is served are the owed policy ruling (G), so the remedy names the options; rejected: a bug-bounty platform, which is a new service needing sign-off.