Add documentation that is specific to our org see:
https://source.redhat.com/departments/it/it-information-security/wiki/quayio_security_guidelines
Also document how to add components etc and should include letting ProdSec know they need to add that new repo to their CVE tracking.