diff --git a/docs/security.md b/docs/security.md index e4b28f7385..cb2f3e1715 100644 --- a/docs/security.md +++ b/docs/security.md @@ -19,3 +19,18 @@ We will publish security advisiories using the [GitHub Security Advisories](https://github.com/argoproj/argo-rollouts/security/advisories) feature to keep our community well informed, and will credit you for your findings (unless you prefer to stay anonymous, of course). + +## Internet Bug Bounty collaboration + +We're happy to announce that the Argo project is collaborating with the great +folks over at +[Hacker One](https://hackerone.com/) and their +[Internet Bug Bounty program](https://hackerone.com/ibb) +to reward the awesome people who find security vulnerabilities in the four +main Argo projects (CD, Events, Rollouts and Workflows) and then work with +us to fix and disclose them in a responsible manner. + +If you report a vulnerability to us as outlined in this security policy, we +will work together with you to find out whether your finding is eligible for +claiming a bounty, and also on how to claim it. +