How to contact for security issues & Adding security policy

[arkark]

Summary

I found a security issue in radash, but I could not find the way to contact the project maintainers privately. May I ask you to tell me a contact method you prefer?

FYI

I suggest you to put SECURITY.md (a security policy) at the root.

As another choice, if the project maintainers enable "Private vulnerability reporting" on GitHub, I can report the issue privately.

• ref: https://docs.github.com/en/code-security/security-advisories/working-with-repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository#enabling-or-disabling-private-vulnerability-reporting-for-a-repository

[aleclarson]

Hello @arkark, if the same vulnerability exists in Radashi (a maintained version of Radash), please see our SECURITY.md document for next steps.

[arkark]

Hello, I'll check it when I have time. Thanks.