Add IRP

Author: jonobr1

SECURITY.md

@@ -1,17 +1,15 @@
 # Security Policy
 
 If you have discovered a security vulnerability in this project, please report it
-privately. **Do not disclose it as a public issue.** This gives us time to work with you
-to fix the issue before public exposure, reducing the chance that the exploit will be
-used before a patch is released.
+privately. **Do not disclose it as a public issue.** This gives us time to work with you to fix the issue before public exposure, reducing the chance that the exploit will be used before a patch is released.
 
-You may submit the report in the following ways:
+**You may submit the report in the following ways:**
 
-- Github users can privately report security advisories directly here: https://github.com/jonobr1/two.js/security/advisories/new
+- Github users can privately report security advisories directly [here](https://github.com/jonobr1/two.js/security/advisories/new)
 
-- Send an email to inquiries+two.js@jono.fyi.
+- Send an email to [inquiries+two.js@jono.fyi](mailto:inquiries+two.js@jono.fyi).
 
-Please provide the following information in your report:
+**Please provide the following information in your report:**
 
 - The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting)
 - Full paths of source file(s) related to the manifestation of the issue
@@ -21,5 +19,12 @@ Please provide the following information in your report:
 - Proof-of-concept or exploit code (if possible)
 - Impact of the issue, including how an attacker might exploit the issue
 
-This project is maintained by volunteers on a reasonable-effort basis. As such,
-we ask that you give us 90 days to work on a fix before public exposure.
+This project is maintained by volunteers on a reasonable-effort basis. As such, we ask that you give us 90 days to work on a fix before public exposure.
+
+<br />
+
+---
+
+<br />
+
+_Two.js conforms to this [Incident Response Plan](https://two.js.org/incident-response-plan) in moments of security risks._

feature-request.md

@@ -0,0 +1,63 @@
+---
+pageClass: fine-print
+title: Two.js Incident Response Plan
+lang: en-US
+---
+
+# Incident Response Plan
+
+### Principles:
+
+- **Transparency:** All incidents and fixes are documented here for the community.
+- **Stewardship:** Take responsibility for protecting users and the project.
+- **Protection:** Act to minimize harm and provide guidance.
+
+# How Two.js Handles Incidents
+
+### 1. Detection & Triage
+
+- We monitor security reports sent via [security](/security) outreach, GitHub advisories, issues, and npm notifications.
+- If we spot a bug or report that looks like a security risk, we treat it as an incident.
+
+### 2. Assessment
+- Check the severity:
+  - **Critical:** npm package or repo compromised, malicious code, supply chain attack.
+  - **High:** Vulnerabilities that allow code execution, XSS, or leak secrets.
+  - **Medium:** Denial of service, memory leaks, or integrity issues.
+  - **Low:** Docs defacement, minor regressions.
+
+### 3. Response
+- Acknowledge the report (privately if sensitive, publicly if not).
+- For critical/high issues:
+  - Rotate any exposed secrets/tokens.
+  - Patch the bug or vulnerability.
+  - Deprecate or yank affected npm versions if needed.
+  - Rebuild and redeploy docs/site from a clean commit.
+- For medium/low issues:
+  - Patch and document the fix.
+
+### 4. Communication
+- Update this wiki page with a summary of the incident and the fix.
+- For major issues, we post a GitHub Release note and a pinned Issue.
+- Provide upgrade or mitigation steps for users.
+
+### 5. Recovery & Hardening
+- After fixing, review what happened and update this process if needed.
+- Add tests or automation to prevent similar issues.
+- Rotate credentials and check repo/npm security settings.
+
+<br />
+
+---
+
+# Recent Incidents & Fixes
+
+<br />
+
+- None at this time
+
+<br />
+
+---
+
+**If you spot a security issue, please report it via [security](/security) outreach. We’ll respond as quickly as possible.**

wiki/incident-response-plan/README.md

@@ -0,0 +1,36 @@
+---
+pageClass: fine-print
+title: Two.js Security Policy
+lang: en-US
+---
+
+# Security Policy
+
+If you have discovered a security vulnerability in this project, please report it
+privately. **Do not disclose it as a public issue.** This gives us time to work with you to fix the issue before public exposure, reducing the chance that the exploit will be used before a patch is released.
+
+**You may submit the report in the following ways:**
+
+- Github users can privately report security advisories directly [here](https://github.com/jonobr1/two.js/security/advisories/new)
+
+- Send an email to [inquiries+two.js@jono.fyi](mailto:inquiries+two.js@jono.fyi).
+
+**Please provide the following information in your report:**
+
+- The type of issue (e.g., buffer overflow, SQL injection, or cross-site scripting)
+- Full paths of source file(s) related to the manifestation of the issue
+- The location of the affected source code (tag/branch/commit or direct URL)
+- Any special configuration required to reproduce the issue
+- Step-by-step instructions to reproduce the issue
+- Proof-of-concept or exploit code (if possible)
+- Impact of the issue, including how an attacker might exploit the issue
+
+This project is maintained by volunteers on a reasonable-effort basis. As such, we ask that you give us 90 days to work on a fix before public exposure.
+
+<br />
+
+---
+
+<br />
+
+_Two.js conforms to this [Incident Response Plan](https://two.js.org/incident-response-plan) in moments of security risks._