Add paragraph on undefined behaviour
Add a note that we do aim to protect against undefined behaviour and
undefined behaviour in certificate parsing is in scope.
Signed-off-by: David Horstmann <david.horstmann@arm.com>
diff --git a/SECURITY.md b/SECURITY.md
index b4d564e..e6d0bbf 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -149,3 +149,8 @@
validation is performed separately to ensure that they are compliant to the
relevant specifications. This makes Mbed TLS on its own unsuitable use in a
Certificate Authority (CA).
+
+However, Mbed TLS aims to protect against memory corruption and other
+undefined behavior when parsing certificates and CSRs. If a CSR or signed
+certificate causes undefined behavior when it is parsed by Mbed TLS, that
+is considered a security vulnerability.