[mc-nv]

What does the PR do?

• Adds SECURITY.md, which this repository did not have. Flagged by an AIVO asset review.
• Uses NVIDIA's current standard template, as in NVIDIA/NeMo, cuda-python and Megatron-LM. Text is NVIDIA-authored, unmodified except the platform-neutral "GitHub/GitLab" wording from cuda-python.
• Reporting policy only: no threat model or architecture section.
• Applied across all Triton repositories.

Checklist

• PR title reflects the change and is of format <commit_type>: <Title>
• Changes are described in the pull request.
• Related issues are referenced.
• Populated github labels field
• Added test plan and verified test passes.
• Verified that the PR passes existing CI.
• Verified copyright is correct on all changed files.
• Added succinct git squash message before merging ref.
• All template sections are filled out.
• Optional: Additional screenshots for behavior/output changes with before/after.

Commit Type:

Check the conventional commit type
box here and add the label to the github PR.

• build
• ci
• docs
• feat
• fix
• perf
• refactor
• revert
• style
• test

Related PRs:

• docs: Adopt current NVIDIA SECURITY.md template server#8997

Where should the reviewer start?

• SECURITY.md — compare against NVIDIA/NeMo/SECURITY.md for the canonical wording.

Test plan:

• Documentation only; no code paths affected.

• CI Pipeline ID:

Caveats:

• NVIDIA ships two variants of the warning sentence: NVIDIA/NeMo says "through GitHub", NVIDIA/cuda-python says "through GitHub/GitLab". This PR uses the latter because Triton repositories exist on both GitHub and internal GitLab.
• The template's PGP wording is "we encourage you" rather than a hard requirement. Kept as-is for template fidelity; raised on docs: Adopt current NVIDIA SECURITY.md template server#8997.

Background

An AIVO asset review (securityportal.nvidia.com/aivo/assets) flagged Triton repositories with no SECURITY.md. Rather than authoring per-repository security documentation, every repository adopts NVIDIA's current standard template so the policy is identical everywhere and carries no repository-specific claims to maintain.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

• Resolves: TRI-1935

[greptile-apps]

Confidence Score: 5/5

[Low risk] Adds security reporting guidance document.

The PR appears safe to merge; no blocking issue remains in the current policy.

Findings

1.  Mutable tag risk obscured ▶
2.  TLS build constraint omitted ▶

Summary

Adds NVIDIA’s standard vulnerability-reporting policy and removes the earlier repository-specific security guidance.

• Directs reporters to NVIDIA’s PSIRT web form or email instead of GitHub/GitLab.

_{Reviews (4) · Last reviewed commit: "docs: Adopt current NVIDIA SECURITY.md t..."}

[greptile-apps]

Mutable tag risk obscured The new description warns that fetched sources may be “unpinned,” but most dependencies are pinned by Git tags that can be retargeted. The build does not verify signatures or checksums, so a retargeted tag could change the code built without a version change. Omitting this distinction makes the actual supply-chain risk harder to assess.

[greptile-apps]

TLS build constraint omitted The advice to add TLS before exposing services omits that the vendored HTTP library is built with SSL disabled. Triton consumers therefore need external TLS termination and their own request limits and timeouts. Without that context, the deployment guidance is less useful for safely using this library.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!