From 431ddc97fb704d8289682068a4098d0ec1e2a693 Mon Sep 17 00:00:00 2001
From: Syed Muhammad Dawoud Sheraz Ali
 <40599381+DawoudSheraz@users.noreply.github.com>
Date: Fri, 29 Mar 2024 15:48:17 +0500
Subject: [PATCH] docs: Create SECURITY.md (#1023)

* docs: Create SECURITY.md
---
 SECURITY.md | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..3807948
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,19 @@
+# Tutor Ethical Vulnerability Disclosure Policy
+
+
+## Reporting a Vulnerability
+
+To ensure the health of the codebase and the larger Open edX and Tutor communities, please do not create GitHub issues for a security vulnerability. Report any security vulnerabilities or concerns by sending an email to [security.tutor@edly.io](mailto:security.tutor@edly.io). To ensure a timely triage and fix of the security issue, include as many details you can when reporting the vulnerability. Some pieces of information to consider:
+
+* The nature of the vulnerability, e.g.
+  * Authentication and Authorization
+  * Data Integrity and Confidentiality
+  * Security Configurations
+  * Third-party dependencies
+* The impact of the security risk
+* A detailed description of the steps necessary to reproduce the issue
+* The links to the vulnerable code
+* The links to third-party libraries/packages if the vulnerability is present in such a dependency.
+
+## Bug Bounty
+Edly/Tutor does not offer a bug bounty for reported vulnerabilities.