Develop a security policy

[dstebila]

Develop a security policy

[planetf1]

As part of this

• a private mailing list will likely be needed (see lists.pqca.org - need to decide project-specific, pqca level, or both)
• update SECURITY.md across all repos (to point to the authoritative link)

[TheFoxAtWork]

The following templates may be useful in setting this up:

• SECURITY.md
• SECURITY_CONTACTS.md
• embargo-policy.md
• embargo.md
• incident-response.md

It covers @planetf1 's points and then some.

[planetf1]

At the TSC meeting held 2023-05-23 We agreed to

• Create a SECURITY.md in each repository
• Enable github private security vulnerability reporting