Add a security policy file and tweak the wording in the README to make it clear that this is just sample code and not something you get CVEs for...

Author: michaelrsweet

README.md

@@ -1,24 +1,25 @@
 IPP Sample Implementations
 ==========================
 
-This code provides sample, non-production-ready implementations of IPP Clients,
-Printers, Proxies, and Systems.  It makes use of the [CUPS Library v3][LIBCUPS]
-and [PDFio library][PDFIO] projects to provide low-level HTTP, IPP, and PDF
-support.  The `ippserver` and `ipp3dprinter` code was also inspired by the
-original CUPS `ippeveprinter` source code.
+This project provides non-production-ready sample code implementations of IPP
+Clients, Printers, Proxies, and Systems.  It makes use of the
+[CUPS Library v3][LIBCUPS] and [PDFio library][PDFIO] projects to provide low-
+level HTTP, IPP, and PDF support.  The `ippserver` and `ipp3dprinter` code was
+inspired by the original CUPS `ippeveprinter` source code but is separately
+developed and maintained.
 
 ![Version](https://img.shields.io/github/v/release/istopwg/ippsample?include_prereleases)
 ![Apache 2.0](https://img.shields.io/github/license/istopwg/ippsample)
 ![Build and Test](https://github.com/istopwg/ippsample/workflows/Build%20and%20Test/badge.svg)
 ![ipp](https://snapcraft.io/ipp/badge.svg)
 ![Coverity Scan Status](https://img.shields.io/coverity/scan/22384.svg)
 
-> Note: This code is provided for educational purposes only.  While we will make
+> *Note:* This code is provided for educational purposes only.  While we make
 > every effort to ensure the code is bug-free and regularly run the code
-> through dynamic and static analysis tools, it is written for correctness, not
-> performance, and so is not intended for use as a production solution.  This
-> code is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF
-> ANY KIND, either express or implied.
+> through dynamic and static analysis tools, it is written for correctness,
+> not performance, and so is not intended for use or supported as a production
+> solution.  This code is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES
+> OR CONDITIONS OF ANY KIND, either express or implied.
 
 
 Getting the Code
@@ -28,8 +29,9 @@ Getting the Code
 *main project page, as that archive is missing the libcups and PDFio submodules*
 *and will not compile.*
 
-The source code is available in semi-monthly release tarballs or via the Github
-repository.  For a release tarball, run the following commands:
+The source code is available in semi-monthly (non-production) release tarballs
+or via the Github repository.  For a release tarball, run the following
+commands:
 
     tar xvzf ippsample-VERSION.tar.gz
     cd ippsample-VERSION
@@ -103,6 +105,7 @@ The following documentation files may be of use as well:
 - `INSTALL.md`: Detailed build instructions
 - `PI.md`: How to build ippsample for various Raspberry Pi boards
 - `SCRIPTING.md`: How to use the ippserver REST API
+- `SECURITY.md`: The security policy for this project
 - `TESTING.md`: How to test ippserver with the sample configuration under the
   `test` subdirectory
 - `man/*`: Man pages for each of the ippsample programs in nroff and HTML

SECURITY.md

@@ -0,0 +1,32 @@
+Security Policy
+===============
+
+This file describes how security issues are reported and handled, and what the
+expectations are for security issues reported to this project.
+
+
+This is a Sample Code Project
+-----------------------------
+
+This project provides non-production-ready sample code implementations of IPP
+Clients, Printers, Proxies, and Systems.
+
+> *Note:* This code is provided for educational purposes only.  While we make
+> every effort to ensure the code is bug-free and regularly run the code
+> through dynamic and static analysis tools, it is written for correctness,
+> not performance, and so is not intended for use or supported as a production
+> solution.  This code is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES
+> OR CONDITIONS OF ANY KIND, either express or implied.
+
+
+How to Report a Security Bug
+----------------------------
+
+Security bugs in the ["libcups"][LIBCUPS] and ["libcups/pdfio"][PDFIO]
+directories should be reported using the security policies for those projects.
+
+Security bugs in the "server" and "tools" directories should be reported to the
+GitHub issue tracker at <https://github.com/istopwg/ippsample/issues>.  We do
+not request CVEs for security issues nor will security organizations issue CVEs
+for security bugs since this project only contains non-production-ready sample
+code.