From eb4f9895619b8d5f311a5f467870a98985a5aa96 Mon Sep 17 00:00:00 2001
From: Wolfgang Pempe <pempe@dfn.de>
Date: Mon, 10 Feb 2025 11:39:11 +0100
Subject: [PATCH] Edit infraproxy.md, fixed link and added a list item about
 the NFDI-AAI security list

---
 docs/infraproxy.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/infraproxy.md b/docs/infraproxy.md
index d173f56..75978c4 100644
--- a/docs/infraproxy.md
+++ b/docs/infraproxy.md
@@ -16,13 +16,14 @@ The Infrastructure Proxy is operated by DFN-CERT on behalf of DFN. For all quest
 ### Technical Aspects
 - Make sure that the service supports and is able to consume the Community Attribute Profiles specified in the current version of the [Infrastructure Attribute Policy](policies.md#nfdi-policies) 
 - The connection to the infra proxy is always established via OpenID Connect:
-    - The configuration URL of the Proxy's OP component: https://infraproxy.nfdi-aai.dfn.de/.well-known/openid-configuration
+    - The configuration URL of the Proxy's OP component: [https://infraproxy.nfdi-aai.dfn.de/.well-known/openid-configuration](https://infraproxy.nfdi-aai.dfn.de/.well-known/openid-configuration)
     - For registering a service, we'd need at least one **redirect_uri**, in exchange for a **client_id** and a **client_secret**. 
     - The final integration is usually done in an interactive session (video conference).
 
 ### Data Protection, Formal Aspects
 - Please provide at least a German privacy statement for the service. There are German and English templates available as part of the [NFDI-AAI policy framework](policies.md)
 - As part of the policy framework, there are also [templates available](policies.md) for Service Acceptable Use and Service Access Policies, which are both optional. If you're planning to make use of such documents, please let us know.
+- Provide a security contact for the service and register the email address with the [NFDI-AAI Security List](https://www.listserv.dfn.de/sympa/subscribe/nfdi-aai-security), which is used as incident response information channel.
 - As official operator of the Infrastructure Proxy, the DFN acts as data processor ("Auftragsverarbeiter") for the operator of the service. A ready-made Data Processing Agreement ("Auftragsverarbeitungsvereinbarung") exists for this purpose. The DFN-Team takes care of the paperwork.  
 
 ## Contact information
-- 
GitLab