Add link to security policy and vulnerability workflow from READMEs (#5644)

.portal-docs/docker-hub/README.aspire-dashboard.md

@@ -128,6 +128,8 @@ View the current tags at the [Microsoft Artifact Registry portal](https://mcr.mi
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/docker-hub/README.aspnet.md

@@ -90,6 +90,8 @@ View the current tags at the [Microsoft Artifact Registry portal](https://mcr.mi
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/docker-hub/README.monitor-base.md

@@ -71,6 +71,8 @@ View the current tags at the [Microsoft Artifact Registry portal](https://mcr.mi
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/docker-hub/README.monitor.md

@@ -73,6 +73,8 @@ View the current tags at the [Microsoft Artifact Registry portal](https://mcr.mi
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/docker-hub/README.runtime-deps.md

@@ -71,6 +71,8 @@ View the current tags at the [Microsoft Artifact Registry portal](https://mcr.mi
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/docker-hub/README.runtime.md

@@ -79,6 +79,8 @@ View the current tags at the [Microsoft Artifact Registry portal](https://mcr.mi
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/docker-hub/README.samples.md

@@ -98,6 +98,8 @@ These sample images are not intended for production use and may be subject to br
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/docker-hub/README.sdk.md

@@ -81,6 +81,8 @@ View the current tags at the [Microsoft Artifact Registry portal](https://mcr.mi
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/mar/README.aspire-dashboard.portal.md

@@ -124,6 +124,8 @@ Limits are per-resource. For example, a `MaxLogCount` value of 10,000 configures
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ### Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/mar/README.aspnet.portal.md

@@ -86,6 +86,8 @@ The [Image Variants documentation](https://github.com/dotnet/dotnet-docker/blob/
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ### Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/mar/README.monitor-base.portal.md

@@ -67,6 +67,8 @@ The following Dockerfiles demonstrate how you can use this base image to build a
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ### Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/mar/README.monitor.portal.md

@@ -69,6 +69,8 @@ See the [documentation](https://go.microsoft.com/fwlink/?linkid=2158052) for how
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ### Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/mar/README.runtime-deps.portal.md

@@ -67,6 +67,8 @@ The [Image Variants documentation](https://github.com/dotnet/dotnet-docker/blob/
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ### Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/mar/README.runtime.portal.md

@@ -75,6 +75,8 @@ The [Image Variants documentation](https://github.com/dotnet/dotnet-docker/blob/
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ### Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/mar/README.samples.portal.md

@@ -94,6 +94,8 @@ These sample images are not intended for production use and may be subject to br
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ### Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

.portal-docs/mar/README.sdk.portal.md

@@ -77,6 +77,8 @@ The [Image Variants documentation](https://github.com/dotnet/dotnet-docker/blob/
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ### Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

README.aspire-dashboard.md

@@ -142,6 +142,8 @@ You can retrieve a list of all available tags for dotnet/aspire-dashboard at htt
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

README.aspnet.md

@@ -276,6 +276,8 @@ For tags contained in the old dotnet/core/aspnet repository, you can retrieve a
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

README.md

@@ -106,6 +106,8 @@ The [Image Variants documentation](https://github.com/dotnet/dotnet-docker/blob/
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

README.monitor-base.md

@@ -97,6 +97,8 @@ You can retrieve a list of all available tags for dotnet/monitor/base at https:/
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

README.monitor.md

@@ -107,6 +107,8 @@ You can retrieve a list of all available tags for dotnet/monitor at https://mcr.
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

README.runtime-deps.md

@@ -189,6 +189,8 @@ For tags contained in the old dotnet/core/runtime-deps repository, you can retri
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

README.runtime.md

@@ -232,6 +232,8 @@ For tags contained in the old dotnet/core/runtime repository, you can retrieve a
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

README.samples.md

@@ -140,6 +140,8 @@ These sample images are not intended for production use and may be subject to br
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

README.sdk.md

@@ -202,6 +202,8 @@ For tags contained in the old dotnet/core/sdk repository, you can retrieve a lis
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 ## Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)

eng/readme-templates/Support.md

@@ -30,6 +30,8 @@
 * **AND** the CVE is in a package that is added in our Dockerfile layers (meaning the CVE is in a package we explicitly install or any transitive dependencies of those packages)
 * **AND** there is a CVE fix for the package available in the affected base image's package repository.
 
+Please refer to the [Security Policy](https://github.com/dotnet/dotnet-docker/blob/main/SECURITY.md) and [Container Vulnerability Workflow](https://github.com/dotnet/dotnet-docker/blob/main/documentation/vulnerability-reporting.md) for more detail about what to do when a CVE is encountered in a .NET image.
+
 {{ARGS["top-header"]}}# Feedback
 
 * [File an issue](https://github.com/dotnet/dotnet-docker/issues/new/choose)