@allenhouchins Documenting our VDP
## Summary
- Adds a pointer to Fleet's public Bugbop Vulnerability Disclosure
Program from `SECURITY.md` and `handbook/it/security.md`.
- Documents the program's in-scope, out-of-scope, and
typically-not-eligible categories so researchers can self-triage before
submitting.
- Keeps `security@fleetdm.com` as the channel for coordinated,
non-public disclosure.
Motivation: two recent informal disclosures (missing CAA, missing
MTA-STS) revealed that our published policy made no mention of the VDP
or its scope, which left the boundary ambiguous when declining
out-of-scope submissions.
## Test plan
- [ ] Verify rendered `SECURITY.md` on the repo's Security tab links to
the Bugbop program.
- [ ] Verify the handbook page renders the new VDP paragraph in the
"Disclosure" section without breaking surrounding structure.
- [ ] Confirm no internal/private program details are referenced.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
- In tests and documentation, replace `@fleetdm.com` with `@example.com`
- In documentation, replace `hello@fleetdm.com` with `fleetdm.com/contact`
- In documentation, replace `security@fleetdm.com` with `fleetdm.com/contact`
- In Dockerfiles, replace `engineering@fleetdm.com` with `hello@fleetdm.com`. These two files are the only remaining files with a `@fleetdm.com` email.
