Add security policy with PGP keys

[TheBlueMatt]

Closes #1246.

[codecov-commenter]

Codecov Report

Merging #1589 (5506360) into main (f3d5b94) will decrease coverage by 0.01%.
The diff coverage is n/a.

❗ Current head 5506360 differs from pull request most recent head 92919c8. Consider uploading reports for the commit 92919c8 to get more accurate results

@@            Coverage Diff             @@
##             main    #1589      +/-   ##
==========================================
- Coverage   91.07%   91.06%   -0.02%     
==========================================
  Files          80       80              
  Lines       44128    44128              
  Branches    44128    44128              
==========================================
- Hits        40190    40183       -7     
- Misses       3938     3945       +7     

Impacted Files	Coverage Δ
lightning/src/ln/payment_tests.rs	98.88% <0.00%> (-0.38%)	⬇️
lightning/src/util/events.rs	41.66% <0.00%> (-0.33%)	⬇️
lightning/src/ln/functional_tests.rs	97.05% <0.00%> (-0.06%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f3d5b94...92919c8. Read the comment docs.

[ariard]

Fingerprint attached to my name is correct.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

commit 0a06a6691dc54b5290e2198db8526eb46ece68ea
Author: Matt Corallo <[email protected]>
Date:   Sat Jul 2 15:29:50 2022 +0000

    Add security policy with PGP keys
    
    Closes #1246.

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..c740a188
- --- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,19 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities, including denial-of-service
+vulnerabilities via email to [email protected].
+
+If possible, please PGP-encrypt such emails to the following keys (available on
+keyservers and WKD via `gpg --auto-key-locate wkd  --locate-external-keys
[email protected] [email protected]`). Please include
+your own public key as an attachment or inline for replies.
+
+ * 07DF3E57A548CCFB7530709189BBB8663E2E65CE (Matt Corallo)
+ * 5DBC576CCCF546CA72AB06CE912EF12EA67705F5 (Jeffrey Czyz)
+ * 729E9D9D92C75A5FBFEEE057B5DD717BEF7CA5B1 (Wilmer Paulino)
+ * BD6EED4D339EDBF7E7CE7F8836153082BDF676FD (Elias Rohrer)
+ * 6E0287D8849AE741E47CC586FD3E106A2CE099B4 (Valentine Wallace)
+ * 69CFEA635D0E6E6F13FD9D9136D932FCAC0305F0 (Arik Sosman)
+ * A5A6868D7AA91DD00AC1A67F817FFA028EF61C94 (Antoine Riard)
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEpaaGjXqpHdAKwaZ/gX/6Ao72HJQFAmLDktUACgkQgX/6Ao72
HJTYYQ//ShvXv4ChTab7q6mHMYEuU+Fz22j7J37FUvY8lf8a7bGU4DB87jyzxpYx
bQ73Q3o9jl/qlciQqvtfVNrhbuphpkmWl9m2mcjUM/b9dSFJr/b0oauA1B4N87kF
OeMef5K/iiH2bvYkki5nnYOf8FCqnVUVUKRfiZsUtgStLh7tXUaShGPwM7pNsH3b
/0jDAb/dNlnf3XipUW/YPmtqC1KUrz2fyLXg7qX5kTta5q5VyGV1D28HuGfa8dMV
1N/vOt6EkcdoMwfA4AtvY2Eu2n6KUK2/q2lG7DK9IP48fOwd4uFMFCQRLpWd0/vQ
bPP9POa9NJmZ2DhYcu7W8vvu/Ssn2xgyPYvXYEkwoiwWH4V7agRO5oapRzA8xQ95
DpIz6E8szHWaosiHG4JIVGUk06mM/oZrNrhhwJTHnsDFy3RiRBeSFQ3YTFFynvgc
VCjIcq8+rw6AazhAq35k58t6fAvOcpc8GNF0fgNE6pZuT6/OSqgh/vFDrhA4yTqm
1bm3cU4afmEuAVyK+9b7SPvjDgYHOLXm7rQ7W2fGA5HC7hhJJKwadWVNjETliUXZ
goSYuid9ko1nCg/kd5uVGUwG6mHBpXrVDsEjiGAxtCosKPkbHmJEp0m2Rp0n88/F
wIYJBCrcoaGwsdivr8L1Uf1YcGu92Y1APqHCg0LzNhcahyo1PjY=
=wc9K
-----END PGP SIGNATURE-----

[ariard]

Any thinking how long are we going to backport security fixes ? Or we just advice users to upgrade to latest versions ?

[TheBlueMatt]

Yea, good question. I wasn't gonna think about it until 0.1, at least, but we'll have to talk about it when we get there?

[ariard]

Yep, for sure.

[TheBlueMatt]

Squashed the fixup without changes.