Security page: say how a vulnerability report is handled

security/index.mdx

@@ -43,6 +43,12 @@ _Fly.io corporate security, compliance, and shared responsibility._
 
 ---
 
-## Talk to the security team
+## Reporting a vulnerability
 
-If you have a security question, concern, or believe you’ve found a vulnerability in any part of our infrastructure, please contact us. You can reach us at [**security@fly.io**](mailto:security@fly.io), and we can provide you with a Signal number if needed to convey sensitive information.
+If you believe you have found a vulnerability in any part of Fly.io, email [**security@fly.io**](mailto:security@fly.io). If you need an encrypted channel, ask and we will set one up. Our machine-readable contact file is at [fly.io/.well-known/security.txt](https://fly.io/.well-known/security.txt).
+
+What to include: the affected component or hostname, steps to reproduce, and what you were able to access. Do not access, modify, or exfiltrate customer data beyond what is needed to demonstrate the issue, and do not test against other customers' applications.
+
+What to expect from us: we acknowledge reports within 3 business days and tell you when the issue is fixed. We do not run a bug bounty program and do not publish reporter acknowledgments. We ask that you give us a reasonable window to fix the issue before publishing details, and we will tell you if we need more time.
+
+For security questions that are not vulnerability reports, the same address works.