Document security advisory process

docs/vulnerability-management-and-coordinated-disclosure.md

@@ -28,10 +28,27 @@ Reported vulnerabilities are assessed and addressed in a coordinated manner befo
 
 ## **6.4 Security Advisory Process** {#6.4-security-advisory-process-–-placeholder}
 
-:::note
-This is work in progress and not fully implemented yet, as OpenRemote, we are working on this subject and will publish an update soon.
-:::
-
 When security issues affecting OpenRemote software are confirmed, a security advisory may be issued to inform users about the vulnerability and recommended mitigation actions.
 
 Security advisories are reviewed and approved internally before publication and are archived for reference.
+
+People can submit potential vulnerabilities at [Security Advisories](https://github.com/openremote/openremote/security/advisories).  
+Submitted advisories are reviewed by the quality officer or its backups in a timely manner.  
+They decide to accept or reject them. If accepted, a CVE is requested from GitHub.
+
+Once accepted, a fix can be developed in a private fork, created from the advisory page.  
+This is a private repository with limited access and limited functionality. It does not support LFS and does not run any CI/CD actions.
+
+As it does not support LFS, when cloning, use `GIT_LFS_SKIP_SMUDGE=1 git clone https://…` to avoid any problem.  
+If you’re using git worktree, working with a private fork requires you to use a separate remote, this can become quite confusing; working on a fork in a completely separate clone is often easier and less error-prone.  
+Although work on the fork can still be performed in a branch, it does not bring much value.  
+Once a PR is created, it will not appear in the normal PR list, it must be accessed via the advisory page.  
+Similarly, it must be merged from the advisory page and by a person from the “Product Owners” group.
+
+For the merge feature to become available, those persons must be able to bypass the branch policies.  
+This means that “Product Owners” have been added as able to bypass any defined rulesets (as of this writing, there’s only one, “Copilot review for default branch”).    
+In addition, for the merge to succeed, the check that a valid CI/CD has run must be bypassed.  
+This is done by temporarily unchecking the "Do not allow bypassing the above settings" option in the branch protection rules configuration.  
+Don’t forget to re-enable it once the merge has been done.
+
+Once a release including the fix has been made publicly available, publish the advisory.