[mattac21]

Simplifies the security policy to share disclosure repositories with teams only once all of the patches have landed in them for the month and the code is frozen, 10 days before the public disclosure date.

This removed the concept of the "code freeze" entirely, since to external teams (who this security policy is for) the code is always frozen, this is removed. The critical emailing is also removed, and replaced by an email sent once repositories are shared, giving an overview of all vulnerabilities included in the repositories.

[greptile-apps]

Confidence Score: 4/5

[Medium impact] The policy reaches invited teams across the monthly private disclosure repositories.

The PR appears safe to merge, with one non-blocking clarification needed for late patches.

Findings

1.  Late patches lack a schedule ▶

Summary

Updates SECURITY.md so teams receive private repositories only after the month's patches are final.

• Invited teams receive the final monthly patch set before public release.
• Teams can build against patched versions using -rcX tags.

mattac21 explicitly describes removing critical-only emails and code-freeze terminology as intentional.

_{Reviews (1) · Last reviewed commit: "update policy to share disclsoure reposi..." · Reviewed by Greptile}

[linear-code]

FOU-1923