Documentation: Add notices about reporting security flaws

[amotl]

About

This patch follows the suggestion by @Tu0Laj1 at ¹, in order to improve the guidance about reporting security flaws. The SECURITY.rst file has been derived from ². The SECURITY.md file has been derived from ³, as suggested on the review of the patch.

Footnotes

1. https://community.cratedb.com/t/mitigations-for-reported-vulnerability/1676/7 ↩

2. https://github.com/dec0dOS/amazing-github-template/blob/main/%7B%7Bcookiecutter.repo_slug%7D%7D/docs/SECURITY.md ↩

3. https://github.com/electron/electron/blob/main/SECURITY.md ↩

[matriv]

Thank you! I think it looks good, not approving for now, I'll wait for the opinion of others.

[seut]

Why not use and mention Github's Security Advisories functionality?
I think the policy file must be in the markdown format then, using a .md suffix.
I'd prefer mentioning this as the first option and contacting us via mail as the second one.
Even that I totally agree on responsible disclosure, the current phrasing sounds a bit harsh to me, could be understand like we want to hide reported vulnerability issues.
I think a mix between this text and e.g. https://github.com/electron/electron/blob/main/SECURITY.md would be great.

[amotl]

Thanks for your feedback and suggestions. I will adjust the files and content as you suggested. If you want to bring it in early, feel free to take over.

[mfussenegger]

I'd add the SECURITY.md to https://github.com/crate/.github to have it enabled in all repositories.

And I'd also prefer the wording of https://github.com/electron/electron/blob/main/SECURITY.md

[amotl]

Hi again. I've updated the patch according to your suggestions, and will also prepare a similar one for https://github.com/crate/.github. Let me know about any kinds of wording adjustments you would like to see. 🙇

[amotl]

Other than the SECURITY.md, I haven't been able to discover the spot where to adjust the reporting template text. When comparing the "Description" texts below, I also like the template from Electron much better.

Ours: https://github.com/crate/crate-python/security/advisories/new
Electron: https://github.com/electron/electron/security/advisories/new