Add a SECURITY.md

[ReinderVosDeWael]

This PR adds a security policy which informs users on how to inform us of security vulnerabilities in our applications. For an example usage, see the side bar of https://github.com/cmi-dair/cross-species-mapper/ .

Instructions have been added to the README.md to either modify SECURITY.md, or delete it if it's not relevant.

[github-actions]

Coverage Report

File	Stmts	Miss	Cover
TOTAL	10	0	100%

Tests	Skipped	Failures	Errors	Time
4	0 💤	0 ❌	0 🔥	0.077s ⏱️

[codecov]

Codecov Report

Patch and project coverage have no change.

Comparison is base (402d621) 100.00% compared to head (c93fc6a) 100.00%.

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #20   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            1         1           
  Lines           10        10           
=========================================
  Hits            10        10           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[clane9]

Personally I'm a bit opposed to worrying about security. I know this is not the "right way", but I feel like it's often not a necessity for the sort of stuff we're building (cf pybids and nilearn do not have a SECURITY.md). And maintaining a responsible security policy seems hard. My 2c would be to not put this in the template, but add it to projects that require it.

[ReinderVosDeWael]

@gkiar tie breaker on these opposing reviews? :)

[ReinderVosDeWael]

It'd only not be a necessity if there's no vulnerabilities, which means there's no work to do anyway :). Security should always be a concern; it takes but a single significant data leak that makes it into the media to drag CMI's reputation into the gutter.

[gkiar]

Afaict, the policy is just:

• we care about security
• tell us privately so we can address

I see no harm in including that in templates? As @clane9 rightly points out: most of the time this is irrelevant for what we do, and, as @ReinderVosDeWael says, when it is relevant, it's important and we want to cover our bases.