Backlog: Adopt Security Best Practices

[UlisesGascon]

Hey team! 👋

As discussed recently, here’s a coordinated effort to adopt security best practices 🔐

✅ Current PRs

• [x] Configure ~~Dependabot~~ Renovate: ~~https://github.com/lodash/lodash/pull/6029~~ https://github.com/lodash/lodash/pull/6039
• [ ] Add Dependency Review tool: https://github.com/lodash/lodash/pull/6031
• [x] List security team members: https://github.com/lodash/lodash/pull/6036
• [x] Add a Threat Model: https://github.com/lodash/lodash/pull/6026
• [x] Include CNA Escalation in the SECURITY.md: https://github.com/lodash/lodash/pull/6025
• [x] Add Incident Response Plan (IRP): https://github.com/lodash/lodash/pull/6028
• [x] Proactively report the OSSF Scorecard results: https://github.com/lodash/lodash/pull/6030
• [x] Enable CodeQL: https://github.com/lodash/lodash/pull/6032

💬 Open Questions

• [x] In the IRP is included a reference to the Security Triage Team. I will start to work on a proposal to define that team responsibilities and resources (slack channel, private repo...) as described in the IRP proposal (https://github.com/lodash/lodash/pull/6028).

🔖 Important

Let’s use this thread to discuss general Security Best Practices topics, and keep implementation details within each PR for better tracking and organization.