Adjust the SECURITY.md slightly

diff --git a/SECURITY.md b/SECURITY.md
index 6ac90f072939827df1a1f043f3bb2b4221993ec1..e6072ed842aa4b7a8539a32f217bce502bf0a395 100644 (file)
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,7 +1,11 @@
 ## Security Policy
 
+### Before You Report
+
+Please read [Hugo's Security Model](https://gohugo.io/about/security/) first. If the issue reproduces in an upstream project, please report it there — we cannot triage or patch on their behalf.
+
 ### Reporting a Vulnerability
 
-Please report (suspected) security vulnerabilities to **[bjorn.erik.pedersen@gmail.com](mailto:bjorn.erik.pedersen@gmail.com)**. You will receive a response from us within 48 hours. If we can confirm the issue, we will release a patch as soon as possible depending on the complexity of the issue but historically within days.
+If, after the above, you believe you have found a vulnerability in Hugo itself with a concrete, reproducible impact, report it privately to **[bjorn.erik.pedersen@gmail.com](mailto:bjorn.erik.pedersen@gmail.com)**. Include a minimal reproducer, the Hugo version, and the observed vs. expected behavior.
 
-Also see [Hugo's Security Model](https://gohugo.io/about/security/).
+You should receive an initial response within a few days. Confirmed issues are typically patched within days, depending on complexity.