Add SECURITY.md

[JamieSlome]

Hello 👋

I run a security community that finds and fixes vulnerabilities in OSS. A researcher (@ooggle) has found a potential issue, which I would be eager to share with you.

Could you add a SECURITY.md file with an e-mail address for me to send further details to? GitHub recommends a security policy to ensure issues are responsibly disclosed, and it would help direct researchers in the future.

Looking forward to hearing from you 👍

(cc @huntr-helper)

[gruns]

is this potential issue too sensitive to just create a (public) issue here in this repo?

also you create a ton of issues exactly like this, without disclosing any security vulnerabilities

• https://github.com/manbearwiz/youtube-dl-server/issues/100
• https://github.com/ploi-deploy/roadmap/issues/127
• https://github.com/obsproject/obs-studio/issues/6681
• https://github.com/inoda/ontrack/issues/78

is this just a scheme to promote your company, huntr helper? 😉

[gruns]

fwiw, no results for furl when searching on huntr.dev:

[JamieSlome]

@gruns - thanks for all of your feedback on the above.

1. We receive a lot of vulnerability reports, especially against very large projects, and so don't assume that reports should be public by default. We had tried this in the past and got a fair amount of bite back, and so do everything via responsible disclosure now. That said, if a maintainer is happy for a report to be made public, we will always support that :) You can see the report here, which I have now made public for you.
2. In all of the cases listed above, and for all of our outreach, we first request an e-mail address in the SECURITY.md, so that maintainers can select an e-mail address where they want reports to go, plus we can authorize the address that's been created by a permitted maintainer. Until we have that e-mail address, we don't disclose it.
3. By no means are we trying to promote the platform, rather just share the contents of reports, responsibly whilst trying not to share our brand as much as possible. Previously, we included our report URLs directly in these issues, but this also had problems, as this specifically looked like a scheme to promote the company. Hence, we wait for the e-mail address to share the report content.

Also:

And feel free to check out the thousand of vulnerabilities found previously by our researchers:

https://huntr.dev/bounties/hacktivity