Add a requirement/recommendation to provide a SECURITY file with project documentation
Consider requiring/recommending that projects include a SECURITY file in their repositories.
The file should include a pointer to the Eclipse Foundation Vulnerability Reporting Policy along with implementation details that are specific to the project.
What implementation details should be included in the file?
- By what mechanism should vulnerabilities be reported
- How vulnerabilities are tracked by the project team
- By what criteria the project team will decide whether or not a CVE will be requested from the Eclipse Foundation