No place to report a security issue

[nobuto-m]

postgresql-operator/README.md

Lines 152 to 153 in 602d9bc

	## Security
	Security issues in the Charmed PostgreSQL Operator can be reported through [LaunchPad](https://wiki.ubuntu.com/DebuggingSecurity#How%20to%20File). Please do not use GitHub to submit security issues.

The README suggests not to use this Github repository for reporting security issues. However, there is no information what exact Launchpad project to use for such a report.

[github-actions]

https://warthogs.atlassian.net/browse/DPE-5151

[nobuto-m]

I filed it under https://bugs.launchpad.net/postgresql-charm/+bug/2076956 for the time being.

[taurus-forever]

Hi @nobuto-m , we have placed this information under the Contact form: https://charmhub.io/postgresql/docs/r-contacts

Report security issues through Launchpad

It is to involve Canonical Security Team, to avoid early leaking and proper CVE handling when necessary.

We will keep this opened to handle the report https://bugs.launchpad.net/postgresql-charm/+bug/2076956
CC: @marceloneppel , @dragomirp , consider to set password (and maybe listen admin on localhost only).
Thank you for helping us making our charm better!

[nobuto-m]

Hi @nobuto-m , we have placed this information under the Contact form: https://charmhub.io/postgresql/docs/r-contacts

Report security issues through Launchpad

It is to involve Canonical Security Team, to avoid early leaking and proper CVE handling when necessary.

That's the exact point of this issue. The linked page states the following.

How to File

New security bugs should be created in the Ubuntu bug tracker (Launchpad). If you do not have a Launchpad account and prefer not to create one, you may send your report to [email protected]. We also accept GPG-encrypted mail.

To report a security vulnerability in an Ubuntu package, follow the regular bug-filing instructions, but take special note of the "Mark as security issue" check box near the bottom of the form:

And to report a security issue in Launchpad, this project has to be tracked in Launchpad. Because it's not about Ubuntu packages or anything like that.