diff --git a/.forgejo/SECURITY.md b/.forgejo/SECURITY.md
index 8f6d111ff..d97c02fd9 100644
--- a/.forgejo/SECURITY.md
+++ b/.forgejo/SECURITY.md
@@ -12,11 +12,11 @@ If you'd like to be notified of new potential security concerns, you can [sign-u
 
 ## Reporting a Vulnerability
 
-If you've found an issue that likely has no impact on existing users (For example, an issue only in the development branch)
+If you've found an issue that likely has no impact on existing users (for example, an issue only in the development branch)
 feel free to raise it via a standard Codeberg bug report issue.
 
 If the issue could have a security impact on BookStack instances, 
-please directly contact the lead maintainer via email Dan Brown using the [details found here](https://www.bookstackapp.com/links/contact/).
+please directly contact the lead maintainer, Dan Brown, via email using the [details found here](https://www.bookstackapp.com/links/contact/).
 
 When contacting us, please note any names (and optionally any profile/company/website links) that you'd like to be used in
 any attribution within our release notes and content.
@@ -36,4 +36,19 @@ and reported by someone else.
 We can raise CVEs ourselves, but we would only go to the effort for security issues with a significant level of risk to users.
 We typically won't pursue CVEs if there's a lesser level of risk.
 
-_Note: Our reporting may change as the Cyber Resilience Act comes into effect._
\ No newline at end of file
+### Our Announcement Channels
+
+When security issues meet a reasonable level of risk to users, they will be assigned to be addressed via a BookStack "Security Release". When made available, these releases will be announced via our [security mailing list](https://updates.bookstackapp.com/signup/bookstack-security-updates), as a post on [our blog](https://www.bookstackapp.com/blog/), and security notices will be added to our [updates documentation page](https://www.bookstackapp.com/docs/admin/updates/#version-specific-instructions). These releases will also be typically announced in some of our social communities. 
+
+To meet the "reasonable level of risk" for a security release, the issue(s) will typically need to pose a risk to instance/user data and security. Security *improvements* (for example, hardening against denial of service attacks) typically won't trigger a security release by themselves, and may be released as a standard patch release.
+
+CVEs may also be created for security issues, but this is not assured. We only seek CVEs for high-risk issues, although we're very liberal in allowing security researchers to report lesser issues also.
+
+### CRA Reporting
+
+In line with the [Cyber Resilience Act](https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act), we aim to meet certain levels of reporting requirements by reporting the following to the relevant ENISA established single reporting platform:
+
+- Actively exploited vulnerabilities contained in BookStack, when made aware of such exploit use.
+- Severe incidents having an impact on the security of the product (for example, compromised BookStack infrastructure).
+
+