[alangou]

Summary

Private vulnerability reports currently rely on reporters manually following the Markdown advisory template. Add a GitHub reporting form that requires its three core sections while keeping additional details and open questions optional. Validation enforces section completion; individual items within each section remain guidance.

Related Issue

None.

Changes

• Add .github/VULNERABILITY_REPORT.yml with the same five sections and prompts as the advisory template.
• Include existing CVE identifiers and disclosure deadlines in Additional details.
• Link the form from security guidance and align the issue chooser's security contact text with private GitHub reporting.

Testing

• Parsed both changed YAML files and checked section order, required/optional fields, and CVE/disclosure prompts.
• Validated 12 relative documentation links.
• Markdown lint passed for SECURITY.md; contributor skill files are excluded by the repository configuration.
• git diff --check passed.
• Unit and E2E tests are not applicable to these form and documentation changes.

Checklist

• Follows Conventional Commits.
• Commit is signed off (DCO).
• Related security guidance and skill references are synchronized.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[fcano]

LGTM 👍

[alangou]

TODO: don't forget to add CNCF email later

[alangou]

/ok to test e3f3b89