Security bug reports

[saihaj]

Contributing guide in graphql-js https://github.com/graphql/graphql-js/blame/main/.github/CONTRIBUTING.md#L10-L16 links to Facebook bounty program. What is the process under GraphQL Foundation?

cc: @brianwarner @leebyron @IvanGoncharov

[saihaj]

Looking at some other Linux Foundation projects, they suggest to contact security@Project.tld which is a private list that is received by Security officers and maintainers.

• https://www.kernel.org/doc/html/latest/admin-guide/security-bugs.html#contact
• https://github.com/containerd/containerd/blob/main/README.md#reporting-security-issues
• https://prometheus.io/docs/operating/security/

Does foundation have something similar cc @IvanGoncharov @brianwarner ?

[benjie]

We have a security policy now.