Add security policy

[exceptionalcold]

How should security vulnerabilities be reported? Issues and pull requests are publicly visible. If there is a safer way to disclose information about vulnerabilities, can someone document that process and add it to the repo?

https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository

[abandoned-prototype]

Thank you, @exceptionalcold for this report. I agree, that we should add a security policy and I will work on this.
In the meantime, issues can be reported to [email protected]

[michplunkett]

Something like this may be useful if we are in a scenario where someone is in immediate danger: https://stackoverflow.com/a/4909248