Add security policy

SECURITY.md

@@ -0,0 +1,110 @@
+# Security Policy
+
+## Supported Versions
+
+Unless otherwise specified, we recommend to only use the most recent minor
+version release.
+
+## Reporting a Vulnerability
+
+**Please do not file a public ticket** mentioning the vulnerability.
+
+To disclose a vulnerability, please submit a `Security Advisory` via the
+`Security` tab on the impacted repository.
+
+If a repository doesn't have the proper security reporting set up, please email
+`[email protected]` to report the vulnerability.
+
+## Disclosure Policy
+
+Please first submit the vulnerability you discovered using the instructions in
+[Reporting a Vulnerability](#reporting-a-vulnerability). Once you have done so,
+you may share the details with third parties after either of the following,
+whichever is sooner:
+
+- the vulnerability has been fixed and the Celestia program owner has provided
+permission for you to disclose it; or
+- 120 days after you submit the vulnerability
+
+### Scope
+
+The scope of this security policy applies to the code repositories under the
+[@celestiaorg](https://github.com/celestiaorg) and any related infrastructure.
+
+### Rewards
+
+Celestia Labs has no formal reward policy and researchers should not expect a
+reward for discovering a vulnerability. Celestia Labs is nonetheless grateful
+for all legitimate discoveries of vulnerabilities, and is happy to acknowledge
+the vulnerability and the researchers after a fix has been widely deployed.
+
+### Official Communication Channel
+
+All security updates will be communicated via the security advisories in the
+corresponding code repository that the vulnerability was reported.
+
+### Comments on this Policy
+
+If you have suggestions on how this process could be improved please submit a
+pull request.
+
+### Expectation
+
+When working with us according to this policy, you can expect us to:
+
+- Extend the Safe Harbor for your vulnerability research that is related to this
+policy;
+- Work with you to understand and validate your report, including providing a
+timely initial response to the submission;
+- Work to remediate discovered vulnerabilities in a timely manner; and
+- Recognize your contribution to improving our security if you are the first to
+report a unique vulnerability, and your report triggers a code or configuration
+change.
+
+### Ground Rules
+
+To encourage vulnerability research and to avoid any confusion between
+good-faith hacking and malicious attack, we ask that you:
+
+- Play by the rules. This includes following this policy, as well as any other
+relevant agreements. If there is any inconsistency between this policy and any
+other relevant terms, the terms of this policy will prevail;
+- Report any vulnerability you’ve discovered promptly;
+- Avoid violating the privacy of others, disrupting our systems, destroying
+data, and/or harming user experience;
+- Use only the Reporting a Vulnerability steps to report a vulnerability to us,
+and use only the Official Communication Channels to discuss vulnerability
+information with us;
+- Keep the details of any discovered vulnerabilities confidential until they are
+fixed, according to the Disclosure Policy;
+- Perform testing only on in-scope systems, and respect systems and activities
+which are out-of-scope;
+- If a vulnerability provides unintended access to data: Limit the amount of
+data you access to the minimum required for effectively demonstrating a Proof of
+Concept; and cease testing and submit a report immediately if you encounter any
+user data during testing, such as Personally Identifiable Information (PII),
+Personal Healthcare Information (PHI), credit card data, or proprietary
+information;
+- Only interact with test accounts you own or with explicit permission from the
+account holder; and
+- Do not engage in extortion.
+
+### Safe Harbor
+
+When conducting vulnerability research in full compliance with this policy and
+all applicable laws, we consider this research to be:
+
+- Authorized in accordance with the Computer Fraud and Abuse Act (CFAA) (and/or
+similar state laws), and we will not initiate or support legal action against
+you for accidental, good faith violations of this policy;
+- Exempt from the Digital Millennium Copyright Act (DMCA), and we will not bring
+a claim against you for circumvention of technology controls;
+- Exempt from restrictions in our Terms & Conditions that would interfere with
+conducting security research, and we waive those restrictions on a limited basis
+for work done under this policy; and
+- Lawful, helpful to the overall security of the Internet, and conducted in good
+faith.
+
+If at any time you have concerns or are uncertain whether your security research
+is consistent with this policy, please submit a report through one of our
+Official Communication Channels before going any further.