apache · ppkarwasz · Jul 8, 2026 · Jul 7, 2026
diff --git a/content/projects/_index.md b/content/projects/_index.md
@@ -55,7 +55,7 @@ Use the tabs below to jump to projects by their initial. Every project lists a s
   - Advisories:\
     [activemq.apache.org](https://activemq.apache.org/security-advisories)
   - Security page:\
-    [github.com](https://github.com/apache/activemq/blob/main/SECURITY.md)
+    [github.com](https://github.com/apache/activemq/security/policy)
 - <img class="project-logo" src="https://www.apache.org/logos/res/age/default.png" alt="" loading="lazy"> **Apache AGE**
   - **Security contact:**\
     [security@apache.org](mailto:security@apache.org?subject=%5BFINDING%5D%20Apache%20AGE)
@@ -554,7 +554,7 @@ Use the tabs below to jump to projects by their initial. Every project lists a s
   - Advisories:\
     [httpd.apache.org](https://httpd.apache.org/security/vulnerabilities_24.html)
   - Security page:\
-    [github.com](https://github.com/apache/httpd/blob/trunk/SECURITY.md)
+    [github.com](https://github.com/apache/httpd/security/policy)
 - <img class="project-logo" src="https://www.apache.org/logos/res/httpcomponents/default.png" alt="" loading="lazy"> **Apache HttpComponents**
   - **Security contact:**\
     [security@apache.org](mailto:security@apache.org?subject=%5BFINDING%5D%20Apache%20HttpComponents)
@@ -602,7 +602,7 @@ Use the tabs below to jump to projects by their initial. Every project lists a s
   - Advisories (experimental):\
     [security.apache.org](/projects/impala/)
   - Security page:\
-    [github.com](https://github.com/apache/impala/blob/master/SECURITY.md)
+    [github.com](https://github.com/apache/impala/security/policy)
 - <img class="project-logo" src="https://www.apache.org/logos/res/inlong/default.png" alt="" loading="lazy"> **Apache InLong**
   - **Security contact:**\
     [security@apache.org](mailto:security@apache.org?subject=%5BFINDING%5D%20Apache%20InLong)
@@ -912,7 +912,7 @@ Use the tabs below to jump to projects by their initial. Every project lists a s
   - Advisories (experimental):\
     none so far
   - Security page:\
-    [github.com](https://github.com/apache/paimon/blob/master/SECURITY.md)
+    [github.com](https://github.com/apache/paimon/security/policy)
 - <img class="project-logo" src="https://www.apache.org/logos/res/parquet/default.png" alt="" loading="lazy"> **Apache Parquet**
   - **Security contact:**\
     [security@apache.org](mailto:security@apache.org?subject=%5BFINDING%5D%20Apache%20Parquet)
@@ -1203,7 +1203,7 @@ Use the tabs below to jump to projects by their initial. Every project lists a s
   - Advisories:\
     [superset.apache.org](https://superset.apache.org/docs/security/cves)
   - Security page:\
-    [github.com](https://github.com/apache/superset/blob/master/.github/SECURITY.md)
+    [github.com](https://github.com/apache/superset/security/policy)
 - <img class="project-logo" src="https://www.apache.org/logos/res/synapse/default.png" alt="" loading="lazy"> **Apache Synapse**
   - **Security contact:**\
     [security@apache.org](mailto:security@apache.org?subject=%5BFINDING%5D%20Apache%20Synapse)

diff --git a/content/projects/activemq/_index.md b/content/projects/activemq/_index.md
@@ -6,11 +6,11 @@ layout: single
 
 # Reporting
 
-Do you want disclose a potential security issue for Apache ActiveMQ? You can read more about the projects' security policy on their [security page](https://github.com/apache/activemq/blob/main/SECURITY.md), and email your report to the [Apache Security Team](mailto:security@apache.org).
+Do you want disclose a potential security issue for Apache ActiveMQ? You can read more about the projects' security policy on their [security page](https://github.com/apache/activemq/security/policy), and email your report to the [Apache Security Team](mailto:security@apache.org).
 
 # Advisories
 
-This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the [project security page](https://github.com/apache/activemq/blob/main/SECURITY.md). If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
+This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the [project security page](https://github.com/apache/activemq/security/policy). If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
 {.bg-warning}
 
 ## Temporary destination ownership takeover ## { #CVE-2026-54475 }

diff --git a/content/projects/httpd/_index.md b/content/projects/httpd/_index.md
@@ -6,11 +6,11 @@ layout: single
 
 # Reporting
 
-Do you want disclose a potential security issue for Apache HTTP Server? You can read more about the projects' security policy on their [security page](https://github.com/apache/httpd/blob/trunk/SECURITY.md), and email your report to the [Apache HTTP Server Security Team](mailto:security@httpd.apache.org).
+Do you want disclose a potential security issue for Apache HTTP Server? You can read more about the projects' security policy on their [security page](https://github.com/apache/httpd/security/policy), and email your report to the [Apache HTTP Server Security Team](mailto:security@httpd.apache.org).
 
 # Advisories
 
-This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the [project security page](https://github.com/apache/httpd/blob/trunk/SECURITY.md). If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
+This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the [project security page](https://github.com/apache/httpd/security/policy). If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
 {.bg-warning}
 
 ## mod_http2 denial of service ## { #CVE-2026-49975 }

diff --git a/content/projects/impala/_index.md b/content/projects/impala/_index.md
@@ -6,11 +6,11 @@ layout: single
 
 # Reporting
 
-Do you want disclose a potential security issue for Apache Impala? You can read more about the projects' security policy on their [security page](https://github.com/apache/impala/blob/master/SECURITY.md), and email your report to the [Apache Security Team](mailto:security@apache.org).
+Do you want disclose a potential security issue for Apache Impala? You can read more about the projects' security policy on their [security page](https://github.com/apache/impala/security/policy), and email your report to the [Apache Security Team](mailto:security@apache.org).
 
 # Advisories
 
-This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the [project security page](https://github.com/apache/impala/blob/master/SECURITY.md). If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
+This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the [project security page](https://github.com/apache/impala/security/policy). If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
 {.bg-warning}
 
 ## Impala logs contain secrets ## { #CVE-2021-28131 }

diff --git a/content/projects/superset/_index.md b/content/projects/superset/_index.md
@@ -6,11 +6,11 @@ layout: single
 
 # Reporting
 
-Do you want disclose a potential security issue for Apache Superset? You can read more about the projects' security policy on their [security page](https://github.com/apache/superset/blob/master/.github/SECURITY.md), and email your report to the [Apache Superset Security Team](mailto:security@superset.apache.org).
+Do you want disclose a potential security issue for Apache Superset? You can read more about the projects' security policy on their [security page](https://github.com/apache/superset/security/policy), and email your report to the [Apache Superset Security Team](mailto:security@superset.apache.org).
 
 # Advisories
 
-This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the [project security page](https://github.com/apache/superset/blob/master/.github/SECURITY.md). If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
+This section is experimental: it provides advisories since 2023 and may lag behind the official CVE publications. It may also lack details found on the [project security page](https://github.com/apache/superset/security/policy). If you have any feedback on how you would like this data to be provided, you are welcome to reach out on our public [mailinglist](/mailinglist) or privately on [security@apache.org](mailto:security@apache.org)
 {.bg-warning}
 
 ## SQLLab Read-Only Bypass on PostgreSQL ## { #CVE-2026-23984 }

diff --git a/scripts/check-coordinates-with-doap.py b/scripts/check-coordinates-with-doap.py
@@ -29,7 +29,8 @@ def fetch_doap(url):
 
 # manually maintained
 with open('project-coordinates.json', 'r') as p:
-    project_coordinates = json.load(p)
+    # Drop editor-only meta keys (e.g. "$schema"); every remaining key is a project.
+    project_coordinates = {k: v for k, v in json.load(p).items() if not k.startswith('$')}
 
 from rdflib.namespace import DefinedNamespace, Namespace
 from rdflib.term import URIRef