Security disclosure information

[Waterdrips]

We need to create a process for individuals to be able to disclose security vulnerabilities responsibly.

I suggest:

• We create a "SECURITY.md" file with contact information of one/some people here who will be designated security contact.
• Add information to our README/Contributing guide as to how to disclose security issues (not open issues/PRs without contacting security etc)
• Discuses/publish our security patch processes and any backporting we intecnd to do (set the library users expectations)

[Waterdrips]

There are also some things we can enable on the repository like dependabot and some stuff in the "security" tab

[mfridman]

There are also some things we can enable on the repository like dependabot and some stuff in the "security" tab

I enabled the Dependabot.

I'll look into the code scanning, probably using Snyk or the native GitHub feature (CodeQL Analysis). Unless there is a preference for another tool?

[mfridman]

Going to setup CodeQL Analysis by GitHub