[Docs][Security] Clarify reporter credit and CVE publication timing (#55476)

Signed-off-by: Juan Pérez de Algaba <jperezde@redhat.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

SECURITY.md

@@ -8,6 +8,16 @@ Please report security issues privately using [the vulnerability submission form
 
 Reports will then be triaged by the [vulnerability management team](https://docs.vllm.ai/en/latest/contributing/vulnerability_management.html).
 
+## Reporter credit
+
+Credit for a vulnerability is given only to the first reporter. Subsequent
+reports of the same issue are not credited, including independent
+rediscoveries.
+
+We do not credit every submitter. The volume of duplicate and AI-generated
+reports would otherwise create unsustainable workload for the vulnerability
+management team.
+
 ## Threat model
 
 Please see the [Security Guide in the vLLM documentation](https://docs.vllm.ai/en/latest/usage/security.html) for more information on vLLM's security assumptions and recommendations.
@@ -43,6 +53,13 @@ When a security report is accepted, the fix process depends on the severity:
 
 The vulnerability management team reserves the right to adjust the disclosure approach on a case-by-case basis, taking into account factors such as active exploitation, unusual attack surface, or coordination requirements with downstream vendors.
 
+## CVE assignment and advisory publication
+
+After a security advisory has been accepted:
+
+* A CVE is requested when a patch for the advisory is merged.
+* The advisory is published when the fix lands in a vLLM release.
+
 ## Prenotification policy
 
 For certain security issues of CRITICAL, HIGH, or MODERATE severity level, we may prenotify certain organizations or vendors that ship vLLM. The purpose of this prenotification is to allow for a coordinated release of fixes for severe issues.