From 67446251ca0627c845752be3ac7aa7cf38df68d2 Mon Sep 17 00:00:00 2001
From: Nguyen Manh <0xmanhnv@gmail.com>
Date: Tue, 13 Oct 2026 04:36:41 +0000
Subject: [PATCH] docs(readme): how a platform uses the feed, and that no
 signed release exists yet

Links the operator guide on docs.openctem.io (Vulnerability and program
feeds).
---
 README.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/README.md b/README.md
index f7ae709..d9f4846 100644
--- a/README.md
+++ b/README.md
@@ -13,6 +13,20 @@ what scope it publishes and how that changed**. It is not an authorisation to
 test anything: a subscriber reads and accepts a program's terms before any
 active testing, and targets marked `inferred` are suggestions only.
 
+## Using it with your platform
+
+Nothing is installed on your hosts: the platform downloads (or, air-gapped,
+reads) a release, verifies it against the root key id you pin
+(`PROGRAMFEED_ROOT_KEY_ID`) and imports it into the public program monitor. A
+self-hoster can also point the platform at a [local-only
+bundle](#local-only-bundle-self-hosters) (`PROGRAMFEED_LOCAL_BUNDLE_DIR`).
+Setup and how to check the import:
+[Vulnerability and program feeds](https://docs.openctem.io/operations/feeds/)
+on docs.openctem.io.
+
+No signed release is published yet: the first one follows the key ceremony
+in [`keys/README.md`](keys/README.md).
+
 ## Sources
 
 Every source has a **status**: *ingest* (the collector reads it) and