Basic security policy

Author: spoorcc

SECURITY.md

@@ -0,0 +1,25 @@
+# Security Policy
+
+## Reporting Security Issues
+
+If you discover a security vulnerability in Dfetch, please let us know right away and don't post a public issue.
+You can report issues by opening a confidential issue via [GitHub Security Advisories](https://github.com/dfetch/dfetch/security/advisories). See [GitHub's private vulnerability reporting](https://docs.github.com/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability) for more info.
+If you have no contact please contact us through the mail listed in the pyproject.toml.
+
+We appreciate your help in keeping Dfetch safe for everyone.
+We aim to respond to security reports within 5 business days.
+
+## Supported Versions
+
+We actively maintain and patch the latest release of Dfetch.
+Older versions may not receive security updates.
+
+## Disclosure Policy
+
+We ask that you give us a reasonable amount of time to address security issues before public disclosure.
+We will keep you updated on our progress and let you know when the issue has been resolved.
+
+## Acknowledgements
+
+Thank you to everyone who helps keep Dfetch secure!
+We’re grateful for responsible disclosures and contributions from the community.

doc/troubleshooting.rst

@@ -20,3 +20,14 @@ We are glad to help, if you you are stuck, either create an issue_ on github or
 
 .. _issue: https://github.com/dfetch-org/dfetch/issues
 .. _gitter: https://gitter.im/dfetch-org/community
+
+Security issues
+----------------
+
+If you discover a security vulnerability in *Dfetch*, please let us know right away and don't post a public issue.
+You can report issues by opening a confidential issue via `GitHub Security Advisories`_. See
+`GitHub's private vulnerability reporting`_ for more info. If you have no contact please contact us through
+the mail listed in the pyproject.toml.
+
+.. _`GitHub Security Advisories`: https://github.com/dfetch/dfetch/security/advisories
+.. _`GitHub's private vulnerability reporting`: https://docs.github.com/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability)