Merge branch 'master' into apsw-with-sqlalchemy

Author: securestep9

SECURITY.md

@@ -1,11 +1,49 @@
 # Security Policy
 
-## Supported Versions
-The latest release and the current master branch
+At OWASP Nettacker, we take security seriously. This document outlines our security policy, including how to report vulnerabilities, our responsible disclosure process, and how we handle security issues.
 
-## Reporting a Vulnerability
+---
 
-Report a vulnerability to the project maintainers by raising a security advisory [here](https://github.com/OWASP/Nettacker/security/advisories/new)
+## **Supported Versions**
 
-## Contacting Maintainers
-The Project Leaders are listed on the OWASP Nettacker Project page here: [https://owasp.org/nettacker](https://owasp.org/nettacker)
+We provide security updates for the following versions of OWASP Nettacker:
+
+- **Latest Release**: The most recent stable release.
+- **Current Master Branch**: The latest development version on the `master` branch.
+
+Older versions may not receive security updates. We strongly recommend that users upgrade to the latest version.
+
+---
+
+## **Reporting a Vulnerability**
+
+If you discover a security vulnerability in OWASP Nettacker, we appreciate your help in disclosing it responsibly. Here’s how you can report it:
+
+### **1. GitHub Security Advisory**
+- You can report the vulnerability by creating a - **Github Security Advisory**: [OWASP Nettacker Security Page](https://github.com/OWASP/Nettacker/security/advisories/new)
+  - Follow the prompts to submit a **private security advisory**.
+
+### **2. Responsible Disclosure Process**
+- We will acknowledge your report and work with you to establish a timeline for addressing the vulnerability.
+- Once the issue is fixed, we will release a patch and publicly disclose the vulnerability, crediting you (unless you prefer to remain anonymous).
+
+---
+
+## **Vulnerability Handling Process**
+
+1. **Triage**: The Project Leaders will review the report and assess the severity of the vulnerability.
+2. **Fix Development**:  A fix will be developed and tested for the vulnerability.
+3. **Release**: A patched version of OWASP Nettacker will be released.
+4. **Disclosure**: The vulnerability will be publicly disclosed, including credits to the reporter.
+
+---
+
+## **Contacting Maintainers**
+
+For general inquiries or non-security-related issues, you can contact the project leaders:
+
+- **Project Page**: [OWASP Nettacker Project Page](https://owasp.org/nettacker)
+- **GitHub Issues**: [OWASP Nettacker Issues](https://github.com/OWASP/Nettacker/issues)
+- **Slack/Discord**: Join the OWASP Slack workspace and find us in the `#project-nettacker` channel.
+
+For **security-related issues**, please use the private disclosure methods described above.