Add SECURITY.md about furl HOT 3 CLOSED

@gruns - thanks for all of your feedback on the above.

1. We receive a lot of vulnerability reports, especially against very large projects, and so don't assume that reports should be public by default. We had tried this in the past and got a fair amount of bite back, and so do everything via responsible disclosure now. That said, if a maintainer is happy for a report to be made public, we will always support that :) You can see the report here, which I have now made public for you.
2. In all of the cases listed above, and for all of our outreach, we first request an e-mail address in the SECURITY.md, so that maintainers can select an e-mail address where they want reports to go, plus we can authorize the address that's been created by a permitted maintainer. Until we have that e-mail address, we don't disclose it.
3. By no means are we trying to promote the platform, rather just share the contents of reports, responsibly whilst trying not to share our brand as much as possible. Previously, we included our report URLs directly in these issues, but this also had problems, as this specifically looked like a scheme to promote the company. Hence, we wait for the e-mail address to share the report content.

Also:

And feel free to check out the thousand of vulnerabilities found previously by our researchers:

https://huntr.dev/bounties/hacktivity

from furl.

is this potential issue too sensitive to just create a (public) issue here in this repo?

also you create a ton of issues exactly like this, without disclosing any security vulnerabilities

• manbearwiz/youtube-dl-server#100
• ploi/roadmap#127
• obsproject/obs-studio#6681
• inoda/ontrack#78

is this just a scheme to promote your company, huntr helper? 😉

from furl.

fwiw, no results for furl when searching on huntr.dev:

from furl.