start a SECURITY.md

[jcupitt]

Draft for discussion.

[mertalev]

GitHub has a security advisory feature with private reporting and CVE issuance. Maybe that would be a better workflow? They would go to https://github.com/libvips/libvips/security/advisories/new to submit something (e.g. Immich has https://github.com/immich-app/immich/security/advisories/new).

[lovell]

The advisory workflow is only useful after human review of an initial report. Descriptions and attempts at CVSS scoring provided by vulnerability reporters are usually inappropriate/incorrect and in almost all recent cases would not meet the AI policy.

[jcupitt]

Yes, I think triage is a good first step, we have had quite a few false alarms.

[jcupitt]

and in almost all recent cases would not meet the AI policy

Though that only covers contributions intended to be merged to the project, I think, so AI bug reports are fine. Perhaps that's what you mean!

[lovell]

Yeah, I was primarily thinking about LLM-generated code fixes, although anything to help reduce those really boring LLM-generated descriptions would also be welcome.

[mertalev]

Yeah, we do get a lot of false alarms. FWIW they go to a triage tab before anything actually happens, so you can close them without publishing if they're just LLM spam.

[kleisauke]

I would discourage using LLMs for bug/security reports as well, since they are often incorrect or highly misleading (and can therefore waste maintainers time and energy). For a more detailed rationale, see e.g.:
https://book.servo.org/contributing/getting-started.html#ai-contributions
or:
https://openjdk.org/legal/ai

[jcupitt]

Thanks for the review! I've tried to incorporate your comments.

[kleisauke]

A few nitpicks.

[kleisauke]

LGTM, but I'll leave the final review to @lovell, as this is more his area of expertise.