Add a security policy - SECURITY.md file

[JamieSlome]

Hey there!

I belong to an open source security research community, and a member (@r0hanSH) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

[alvarotrigo]

Hey Jamie, sure! I'll add it on the next release!

Meanwhile, feel free to contact me using the contact form.

[JamieSlome]

@alvarotrigo - thanks 👍

I have submitted an e-mail via the contact form. If you want to view the report directly, you can find it here:
https://huntr.dev/bounties/3b9d450c-24ac-4037-b04d-4d4dafbf593a

It is private and only accessible to maintainers with repository write permissions.

[alvarotrigo]

Fixed on v4! 👍

[JamieSlome]

@alvarotrigo - appreciate your time and response here 👍

Would it be possible to mark the report as valid and confirm the fix? Plus there is also a bounty for the fix too, which you are welcome to :)

[alvarotrigo]

Would it be possible to mark the report as valid and confirm the fix?

Done! 👍
Thanks for reporting it and helping out during the process!!

Plus there is also a bounty for the fix too, which you are welcome to :)

Awesome! I didn't know about the bounties!
I'm not sure where the money comes from, but its interesting :)

[JamieSlome]

@alvarotrigo - not at all, you and @r0hanSH did all the leg work!

Awesome! I didn't know about the bounties!
I'm not sure where the money comes from, but its interesting :)

The funds used for bounties are provided by enterprises that are looking to back the repositories and projects that they depend upon, otherwise, we ourselves fund the research 👍

Also, feel free to drop our badge on your README.md to let your community know they can get bounties for finding vulnerabilities, and of course, the fix bounties are always reserved for maintainers!

[alvarotrigo]

Awesome! It's a great initiative!!
I'll add the budget soon!