fix: update security policy details

[lirantal]

New security policy addresses:

1. Intro to a Responsible Security Disclosure policy
2. Establish Security Processes
3. Adopt a Responsible Security Disclosure policy

The most notable changes from your current policy is removal of the following:

• promise - due to the nature of the project being open source, I think it is not very feasible to put an actual number of days as theoretically speaking the project’s team could be out on holiday or vacation. it also conflicts with the SLA of other programs which are mentioned like Snyk or npm because these have their own timeframe and processes set in place which is beyond your control
• rules for reporting - some of them go without mentioning, and some statements there relate more with online services which require no modification of the website, etc.

[juanpicado]

👍 👍 👍 👍 👍 👍 👍 👍 👍 👍 👍

[juanpicado]

Thanks Liran !!

[lock]

🤖This thread has been automatically locked 🔒 since there has not been any recent activity after it was closed.
We lock tickets after 90 days with the idea to encourage you to open a ticket with new fresh data and to provide you better feedback 🤝and better visibility 👀.
If you consider, can attach this ticket 📨to the new one as a reference for better context.
Thanks for being a part of the Verdaccio community! 💘