Add a security policy in our repo, remove outdated statement about versions

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644 (file)
index 0000000..07543de
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,23 @@
+PowerDNS Security Policy
+========================
+
+If you have a security problem to report, please email us at both security@powerdns.com and ahu@ds9a.nl.
+In case you want to encrypt your report using PGP, please use: 
+https://www.powerdns.com/powerdns-keyblock.asc
+
+Please do not mail security issues to public lists, nor file a ticket, unless we do not get back to you in a timely manner.
+We fully credit reporters of security issues, and respond quickly, but please allow us a reasonable timeframe to coordinate a response.
+
+We remind PowerDNS users that under the terms of the GNU General Public License, PowerDNS comes with ABSOLUTELY NO WARRANTY.
+This license is included in this documentation.
+
+HackerOne
+---------
+Security issues can also be reported on [our HackerOne page](https://hackerone.com/powerdns) and might fetch a bounty.
+Do note that only the PowerDNS software is in scope for the HackerOne program, not our websites or other infrastructure.
+
+Disclosure Policy
+-----------------
+- Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
+- Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
+- We will always credit researchers in our security advisories.

diff --git a/docs/common/security-policy.rst b/docs/common/security-policy.rst
index 6114a365608079ceb910d3520e80ef7638b3d5b4..6fef5efad9009bb4f7d99c9650c01a28edcf2e7a 100644 (file)
--- a/docs/common/security-policy.rst
+++ b/docs/common/security-policy.rst
@@ -2,16 +2,14 @@ PowerDNS Security Policy
 ------------------------
 
 If you have a security problem to report, please email us at both security@powerdns.com and ahu@ds9a.nl.
+In case you want to encrypt your report using PGP, please use: https://www.powerdns.com/powerdns-keyblock.asc
+
 Please do not mail security issues to public lists, nor file a ticket, unless we do not get back to you in a timely manner.
 We fully credit reporters of security issues, and respond quickly, but please allow us a reasonable timeframe to coordinate a response.
 
 We remind PowerDNS users that under the terms of the GNU General Public License, PowerDNS comes with ABSOLUTELY NO WARRANTY.
 This license is included in this documentation.
 
-As of the 9th of September 2016, no actual security problems with PowerDNS Authoritative Server 3.4.10, Recursor 3.6.3, Recursor 3.7.2, or later are known about.
-This page will be updated with all bugs which are deemed to be security problems, or could conceivably lead to those.
-Any such notifications will also be sent to all `PowerDNS mailing lists <https://mailman.powerdns.com>`_.
-
 HackerOne
 ^^^^^^^^^
 Security issues can also be reported on `our HackerOne page <https://hackerone.com/powerdns>`_ and might fetch a bounty.