# CRA: Updating SECURITY.md

**URL:** <https://forum.ansible.com/t/cra-updating-security-md/46223>\
**Category:** Project Discussions\
**Tags:** infra-and-security\
**Created:** [August 25, 2026, 12:28pm UTC](https://forum.ansible.com/t/cra-updating-security-md/46223 "2026-08-25T12:28:15Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![gundalow](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/gundalow/32/99_2.png) [@gundalow](https://forum.ansible.com/u/gundalow)\
**Post date:** [August 25, 2026, 12:28pm UTC](https://forum.ansible.com/t/cra-updating-security-md/46223/1 "2026-08-25T12:28:15Z")

</div>

Hi folks

# Summary

You might see some PRs to update `SECURITY.md` updates rolling out across Ansible repos. The process for reporting potential security concerns remains the same, email `security@ansible.com`.

The updates just [clarify the process](https://github.com/ansible-community/project-template/blob/main/.github/SECURITY.md).

# Why we are doing this

As part of Ansible’s review of the EU Cyber Resilience Act, we are making sure that not only do we review our procedures, though we make them easy to find, which means ensuring our repos have direct links to the processes.

The new `SECURITY.md` links to `ansible.com/security`, which currently redirects to [Security Updates](https://access.redhat.com/security/security-updates). The redirect will be updated shortly once the new guides are live on `[docs.ansible.com](http://docs.ansible.com)

# Context

- [Red Hat and the EU Cyber Resilience Act (CRA)](https://www.redhat.com/en/red-hat-eu-cyber-resilience-act)
- [EU Cyber Resilience Act (CRA) and what it means for Ansible?](https://forum.ansible.com/t/eu-cyber-resilience-act-cra-and-what-it-means-for-ansible/45716)
- [Security as Default, Not an Afterthought: The CRA's Real Message](https://forum.ansible.com/t/security-as-default-not-an-afterthought-the-cras-real-message/45795)
- #infra-and-security