[front] sec: add a .well-known security policy (#2000)

README.md

@@ -48,6 +48,7 @@ us on [Discord][tournesol-discord-join].
  - [Structure of the repository](#structure-of-the-repository)
  - [Set-up](#set-up)
  - [Contributing](#contributing)
+ - [Security](#security)
  - [Copyright & Licenses](#copyright--licenses)
 
 ## Structure of the repository
@@ -92,6 +93,10 @@ The code source of the project exists thanks to
 
 Thank you very much!
 
+## Security
+
+To report security vulnerabilities follow our [security policy](./SECURITY.md).
+
 ## Copyright & Licenses
 
 The Tournesol project has chosen to distribute its software and its other

SECURITY.md

@@ -0,0 +1,9 @@
+# Tournesol Security Policy
+
+If you believe you have found a security vulnerability in the Tournesol
+software, please let us know right away using the methods described here:
+
+https://tournesol.app/.well-known/security.txt
+
+If this URI is unavailable, ask for the new security policy by e-mail at
+`security(at)tournesol.app`.

frontend/public/.well-known/security.txt

@@ -0,0 +1,8 @@
+# Report security issues and vulnerabilities here:
+Contact: mailto:[email protected]
+
+# If the date has passed please inform us by email.
+Expires: 2025-08-01T00:00:00.000Z
+
+Preferred-Languages: en,fr
+Canonical: https://tournesol.app/.well-known/security.txt