add security policy

[drakkan]

This should enable reporting private security issues via GitHub

[puellanivis]

Great idea! While we offload our transport security to ssh, we of course, should still take security seriously within our own functionality.

[drakkan]

For some reason the "Report a vulnerability" is still missing. See for example here: https://github.com/drakkan/sftpgo/security.

It must be enabled, see here.

[puellanivis]

I do see it now, so 👍

[drakkan]

I do see it now, so 👍

Hmm, that’s odd, I’m still getting a 404 when I open this link

[puellanivis]

Oh, I looked at the link you linked rather than on our own project’s page. 😐

[drakkan]

I don’t have the necessary permissions to change the settings myself

[puellanivis]

I also do not have permissions.

[eikenb]

I also do not have permissions.

You should have them now. I've added you as an Admin. Sorry about that, didn't realize I was the last admin standing.