PR #4731: Harden vulnerability reporting workflow and policy (#4610)

• Repository: crewAIInc/crewAI
• Author: yuweuii
• State: open | merged: False
• Link: https://github.com/crewAIInc/crewAI/pull/4731

Description (problem / solution / changelog)

Summary

This PR implements issue #4610.

• Scope: [SECURITY] Critical Vulnerability Disclosure
• Source branch: yuweuii:codex/issue-4610
• Commit: f9dea9bd

Linked Issue

Closes #4610

<!-- CURSOR_SUMMARY -->

---

[!NOTE] Low Risk Low risk documentation/template changes plus lightweight tests; main risk is CI failures if template text/paths change unexpectedly.

Overview Strengthens public-facing vulnerability reporting guidance by adding a security notice and mandatory non-security confirmation checkbox to the bug_report.yml issue template, and by exposing private security reporting links via .github/ISSUE_TEMPLATE/config.yml.

Updates .github/SECURITY.md to explicitly direct reporters to GitHub Security Advisories and to document an escalation window if acknowledgements are delayed.

Adds test_security_reporting_templates.py to assert the security policy is present, mentions acknowledgement/escalation timelines, and that the issue templates/config include the expected private security contact information.

^{Written by Cursor Bugbot for commit bb1fa5dec8be543dc7fd23d3fa725eecde4493d4. This will update automatically on new commits. Configure here.}

<!-- /CURSOR_SUMMARY -->

Changed files

• .github/ISSUE_TEMPLATE/bug_report.yml (modified, +13/-0)
• .github/ISSUE_TEMPLATE/config.yml (modified, +8/-1)
• .github/SECURITY.md (renamed, +10/-1)
• lib/crewai/tests/security/test_security_reporting_templates.py (added, +92/-0)