add INCIDENT_RESPONSE.md

Author: GyulyVGC

INCIDENT_RESPONSE.md

@@ -0,0 +1,41 @@
+# Incident Response Plan
+
+This document describes how Sniffnet handles security incidents. <br>
+For how to *report* a vulnerability, see [`SECURITY.md`](https://github.com/GyulyVGC/sniffnet/blob/main/SECURITY.md).
+
+## Scope
+
+An incident is anything that compromises, or could compromise, the integrity
+or safety of Sniffnet or its users:
+
+- a vulnerability in Sniffnet or one of its dependencies
+- a tampered release artifact or compromised signing key
+- unauthorized commits, tags, or releases
+- a compromised maintainer account or the [sniffnet.net](https://sniffnet.net) website
+
+## Roles
+
+- **Incident Lead**: the project maintainer
+  ([@GyulyVGC](https://github.com/GyulyVGC)). Owns the response and all
+  external communication.
+- **Reporter**: credited in the final advisory unless they prefer otherwise.
+- **Trusted contributors**: may be invited into the private advisory to help
+  fix or review.
+
+## Process
+
+1. **Triage.** Open a private
+   [GitHub Security Advisory](https://github.com/GyulyVGC/sniffnet/security/advisories)
+   to track the issue. Confirm it reproduces and assess impact.
+2. **Contain.** If needed, withdraw affected releases, revoke exposed secrets
+   or keys, or revert unauthorized changes.
+3. **Fix.** Develop and review the patch privately. Add a regression test
+   where possible. Rotate anything that might have been exposed.
+4. **Release.** Ship a patched version through the usual channels.
+5. **Disclose.** Publish the advisory (request a CVE if applicable) and note
+   the fix in [`CHANGELOG.md`](https://github.com/GyulyVGC/sniffnet/blob/main/CHANGELOG.md).
+6. **Review.** Write a short post-mortem and file follow-up issues for any
+   gaps it exposes.
+
+Nothing about an unfixed issue is discussed in public issues, PRs, or commit
+messages until disclosure.

SECURITY.md

@@ -20,7 +20,7 @@ Please do the following:
 
 What we promise:
 
-- We will respond to your report within 3 business days with our evaluation of the report and an expected resolution date
+- We will respond to your report with our evaluation and an expected resolution date
 - If you have followed the instructions above, we will not take any legal action against you in regard to the report
 - We will handle your report with strict confidentiality, and not pass on your personal details to third parties without your permission
 - We will keep you informed of the progress towards resolving the problem