From 7bef6e7facfda3b4f033c03a730e436df4a75c76 Mon Sep 17 00:00:00 2001
From: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
Date: Tue, 4 Aug 2026 11:57:28 +1000
Subject: [PATCH 1/2] chore: add SECURITY-INSIGHTS.yml

Modeled on cloudnative-pg/postgres-containers' file: a repository-scoped
file pointing back to the main project.yaml/SECURITY-INSIGHTS.yml via
header.project-si-source, with this repo's own core-team, license,
release distribution points, and actual security tooling (verified
against this repo's real CI workflows and repo settings, not copied
blindly from another repo).

Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>

Assisted-by: Claude
---
 SECURITY-INSIGHTS.yml | 88 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 88 insertions(+)
 create mode 100644 SECURITY-INSIGHTS.yml

diff --git a/SECURITY-INSIGHTS.yml b/SECURITY-INSIGHTS.yml
new file mode 100644
index 0000000000..379c78c40c
--- /dev/null
+++ b/SECURITY-INSIGHTS.yml
@@ -0,0 +1,88 @@
+header:
+  schema-version: 2.2.0
+  last-updated: '2026-08-04'
+  last-reviewed: '2026-08-04'
+  url: https://raw.githubusercontent.com/cloudnative-pg/charts/main/SECURITY-INSIGHTS.yml
+  # reference the main SECURITY-INSIGHTS file from CNPG repo
+  project-si-source: https://raw.githubusercontent.com/cloudnative-pg/cloudnative-pg/main/SECURITY-INSIGHTS.yml
+
+repository:
+  url: https://github.com/cloudnative-pg/charts
+  status: active
+  accepts-change-request: true
+  accepts-automated-change-request: true
+  no-third-party-packages: false
+  core-team:
+    - name: Gabriele Bartolini
+      email: gabriele.bartolini@enterprisedb.com
+      primary: true
+    - name: Francesco Canovai
+      email: francesco.canovai@enterprisedb.com
+      primary: false
+    - name: Leonardo Cecchi
+      email: leonardo.cecchi@enterprisedb.com
+      primary: false
+    - name: Marco Nenciarini
+      email: marco.nenciarini@enterprisedb.com
+      primary: false
+    - name: Itay Grudev
+      # No public email on file -- not an EDB contributor.
+      primary: false
+    - name: Philippe Scorsolini
+      # No public email on file -- not an EDB contributor.
+      primary: false
+  license:
+    url: https://www.apache.org/licenses/LICENSE-2.0
+    expression: Apache-2.0
+
+  release:
+    automated-pipeline: true
+    distribution-points:
+      - uri: oci://ghcr.io/cloudnative-pg/charts/cloudnative-pg
+        comment: Operator Helm chart, published as an OCI artifact
+      - uri: oci://ghcr.io/cloudnative-pg/charts/cluster
+        comment: PostgreSQL Cluster Helm chart, published as an OCI artifact
+      - uri: oci://ghcr.io/cloudnative-pg/charts/plugin-barman-cloud
+        comment: Barman Cloud plugin Helm chart, published as an OCI artifact
+
+  security:
+    tools:
+      - name: Dependabot
+        type: SCA
+        rulesets: ["default"]
+        results: {}
+        integration:
+          adhoc: true
+          ci: false
+          release: false
+      - name: Cosign
+        type: container
+        rulesets: ["default"]
+        results: {}
+        comment: Used to cryptographically sign the published Helm chart OCI artifacts.
+        integration:
+          adhoc: false
+          ci: true
+          release: true
+      - name: GitHub Code Scanning
+        type: SAST
+        rulesets: ["default"]
+        results: {}
+        comment: GitHub's default CodeQL setup, enabled at the repo-settings level.
+        integration:
+          adhoc: false
+          ci: false
+          release: false
+      - name: Chainsaw
+        type: other
+        rulesets: ["default"]
+        results: {}
+        comment: End-to-end tests for the Cluster chart against a real Kubernetes cluster.
+        integration:
+          adhoc: false
+          ci: true
+          release: false
+
+    assessments:
+      self:
+        comment: Refer to the main project.

From 63f2f8fe55fd750ccdf1b236c81b8ce967c464a7 Mon Sep 17 00:00:00 2001
From: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
Date: Tue, 4 Aug 2026 13:21:21 +1000
Subject: [PATCH 2/2] fix: add Itay Grudev's email

Signed-off-by: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>

Assisted-by: Claude
---
 SECURITY-INSIGHTS.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/SECURITY-INSIGHTS.yml b/SECURITY-INSIGHTS.yml
index 379c78c40c..008520d7a3 100644
--- a/SECURITY-INSIGHTS.yml
+++ b/SECURITY-INSIGHTS.yml
@@ -26,7 +26,7 @@ repository:
       email: marco.nenciarini@enterprisedb.com
       primary: false
     - name: Itay Grudev
-      # No public email on file -- not an EDB contributor.
+      email: itay@verito.digital
       primary: false
     - name: Philippe Scorsolini
       # No public email on file -- not an EDB contributor.