LGTM, minor detail — do we want to update this part to make it more aligned with the CNA?
Maybe for the email, we could say that there are 5 business days to respond, and on the 6th day, we advise them to contact the CNA.

Also, I seem to recall that we had agreed not to have a set time frame to respond to reports, although it seems like we only applied that rule when reports are submitted through GitHub