Create SECURITY.md

Author: 1minds3t

SECURITY.md

@@ -0,0 +1,19 @@
+Security Policy
+Reporting a Vulnerability
+The omnipkg team takes security seriously and appreciates the security community's efforts to responsibly disclose vulnerabilities. If you have discovered a security vulnerability, please report it to us as soon as possible.
+Please do not open a public issue. Instead, send an email to 1minds3t@proton.me (or another designated security email address). We will acknowledge your email within 48 hours and will work with you to address the vulnerability.
+Responsible Disclosure Policy
+We will follow a standard responsible disclosure process. Our commitment to you:
+ * We will acknowledge receipt of your vulnerability report in a timely manner.
+ * We will provide you with a timeframe for addressing the vulnerability.
+ * We will credit you for your discovery after the vulnerability has been patched and publicly released, unless you prefer to remain anonymous.
+ * We ask that you do not disclose the vulnerability publicly until we have released a fix. We will work with you to agree on a coordinated public disclosure date.
+Guidelines for Reporters
+We ask you to adhere to these guidelines when researching and reporting vulnerabilities:
+ * Provide a clear, detailed description of the vulnerability, including steps to reproduce it.
+ * Do not disclose the vulnerability or any details about it to third parties or on public forums until we have resolved it and agreed on a public disclosure date.
+ * Do not exploit the vulnerability to access, modify, or destroy user data or system integrity.
+ * Do not engage in activities that could compromise the confidentiality, integrity, or availability of our systems.
+Scope
+This security policy applies to the official omnipkg open-source repository and its published packages.
+Thank you for helping us keep omnipkg secure!