There is a standard for documenting security vulnerability reporting

[izgeri]

Our public repositories should clearly document what process non-employees should do to report potential security bugs. This could involve:

• Including a SECURITY.md file, or similar
• Including a snippet in the README or CONTRIBUTING that refers to the security bug policy
• Other options?

In this effort, we will define the standard way Conjur Open Source repos should document security vulnerabilities, and we will update the current set of public non-archived repositories to follow this process.

AC:

• There is a process defined for documenting how to report security vulnerabilities
• Any new repo templates or guidelines are updated with this policy
• All existing public non-archived repos follow this process

[boazmichaely]

@izgeri just capturing here the Security.md policy which you shared:
https://github.com/cyberark/conjur/blob/master/SECURITY.md