#341 - Add a security policy and a private channel to report vulnerabilities

.github/workflows/notifications.yml

@@ -6,6 +6,9 @@ on:
     tags:
       - '*'
 
+# The job only calls a webhook: no permission for the GITHUB_TOKEN
+permissions: {}
+
 jobs:
   notification:
     runs-on: ubuntu-latest

SECURITY.md

@@ -0,0 +1,20 @@
+Security Policy
+===============
+
+Supported versions
+------------------
+
+Security fixes are released for the latest minor version of the current major version (5.x).
+
+Reporting a vulnerability
+-------------------------
+
+**Do not report security vulnerabilities through public GitHub issues, discussions or pull requests.**
+
+Report them privately with the GitHub form:
+[Report a vulnerability](https://github.com/cleverage/process-bundle/security/advisories/new) (Security tab of this
+repository, "Report a vulnerability").
+
+Please include the affected version, a description of the issue and of its impact, and the steps or the configuration to
+reproduce it. You will receive an answer as soon as possible. Once the vulnerability is confirmed, a fix is prepared in a
+private fork, released, and a security advisory is published, crediting you unless you prefer otherwise.