doc: security policy

Update security levels to triage less reports as critical.
Improve instructions on how to report issues.

SECURITY.md

@@ -15,22 +15,20 @@ experience dealing with past issues, versions affected, common defaults,
 our estimate of exploitation complexity, part of the code affected,
 and use cases. We use the following severity categories:
 
-* **CRITICAL** Severity. This affects Tier 1 features that are enabled by default
-where the issue disrupts availability of the service, leading to severe
-loss of visibility and/or availability. Remotely triggerable traffic
-based code execution, crashes, or evasions with a wide scope are considered to be
+* **CRITICAL** Severity. This affects Tier 1 features that are enabled by default.
+Only remotely triggerable traffic based code execution are considered to be
 in-scope for this severity. These issues will be kept private and will trigger a
 new release of all supported versions. We will attempt to address these as soon
 as possible.
 
-* **HIGH** Severity. This includes issues that are of a lower risk than critical,
-perhaps due to being disabled by default Tier 1 or affecting Tier 2 and
-Community features, or which are less likely to be exploitable. These issues
-will be kept private and will trigger a new release of all supported versions.
-We will attempt to keep the time these issues are private to a minimum; our
-aim would be no longer than a month where this is something under our control.
+* **HIGH** Severity. This affects Tier 1 features that are enabled by default
+where the issue disrupts availability of the service, leading to severe
+loss of visibility and/or availability.
+Remotely triggerable traffic crashes, or evasions with a wide scope are considered to be
+in-scope for this severity.
+We will attempt to keep the time these issues are private to a minimum.
 
-* **MODERATE** Severity. This includes issues like crashes or evasion in Tier 2 and
+* **MODERATE** Severity. This includes issues like crashes or evasions in Tier 2 and
 Community features that are not enabled by default. These will in general be
 kept private until the next release, and that release will be scheduled so
 that it can roll up several such flaws at one time.
@@ -45,6 +43,8 @@ releases.
 Note that we'll be refining the levels based on our experiences with applying them
 to actual issues.
 
+We will review the security level considering both IDS and IPS scenarios.
+
 ## CVE ID's and Github Security Advisories (GHSA)
 
 We will request a CVE ID for an issue if appropriate. Note that multiple
@@ -62,13 +62,23 @@ the issue, together with the redmine security tickets.
 These are documented in https://docs.suricata.io/en/latest/support-status.html
 
 
+## Scope
+
+We are interested in security issues in the Suricata tool itself.
+If you find a security issue in the Suricata API, we can review
+it in a case to case basis.
+Suricata public API documentation is currently a work in progress.
+
 ## Reporting Issues
 
 For reporting security issues, please use `security@oisf.net`.
 
 If you report a security issue to us, please share as much detail about the issue
-as possible: pcaps, attack scripts, potential fixes, etc. If you share pcaps or
-other data, please clearly state if these can (eventually) enter our public CI/QA.
+as possible: pcaps, attack scripts, potential fixes, etc. If you share confidential
+or sensitive data like pcaps, please clearly indicate that,
+in the event that it enters our public domain.
+Always share a reproducer (with a pcap if relevant).
+Usually, the best reproducer is a [suricata-verify test](https://github.com/OISF/suricata-verify#adding-a-new-test).
 
 We will assign a severity and will share our assessment with you.
 
@@ -79,7 +89,7 @@ We will acknowledge you in the release notes, release announcement and GHSA. If
 do not want this, please clearly state this. For the GHSA credits, please give us
 your github handle.
 
-Please let us know if you've requested a CVE ID. If you haven't, we can do it.
+Do not request a CVE ID. We will do it after confirming the issue.
 
 OISF does not participate in bug bounty programs, or offer any other rewards
 for reporting issues.