Merge #679: Add SECURITY.md

78c38363412db3ea1cd1f0cc42dd1624c078ee32 Add SECURITY.md (Jonas Nick)

Pull request description:

  Fixes #646

  WIP because the [email protected] email address doesn't exist yet. But it seems like the right place for vulnerability reports. [email protected] would have the downside that it perhaps reaches more people than necessary. Ideally secp256k1-security would just forward to the three maintainers listed in SECURITY.md. @sipa @apoelstra is it okay to put you there? Fwiw I'm opting out for now because three people should be enough.

  @sipa do you know who to talk to about adding [email protected] and the specifics about how it would work?

ACKs for top commit:
  real-or-random:
    ACK 78c38363412db3ea1cd1f0cc42dd1624c078ee32 I looked at the diff and verified my fingerprint

Tree-SHA512: 53a989615665cf8cf0c6a70d3bc2c4b71b68178cae40b2a7881aa9eba24732d126ba1e258a9fc127c69b47bb3025943097300cfcbbe18736cbf92ff4f3a901e0

diff --combined README.md
index 84c0487902d0df0a65225e48f773aeb8d8fb2ada,06ac500472e0284fddafeca7c7d270346876d028..5603d7b0ee42962a9f09e29978bcb81ff6f5223d
--- 1/README.md
--- 2/README.md
+++ b/README.md
@@@ -23,7 -23,6 +23,7 @@@ Implementation detail
    * Extensive testing infrastructure.
    * Structured to facilitate review and analysis.
    * Intended to be portable to any system with a C89 compiler and uint64_t support.
 +  * No use of floating types, except in benchmarks.
    * Expose only higher level interfaces to minimize the API surface and improve application security. ("Be difficult to use insecurely.")
  * Field operations
    * Optimized implementation of arithmetic modulo the curve's field size (2^256 - 0x1000003D1).
@@@ -71,3 -70,8 +71,8 @@@ Exhaustive test
  With valgrind, you might need to increase the max stack size:
  
      $ valgrind --max-stackframe=2500000 ./exhaustive_tests
+ 
+ Reporting a vulnerability
+ ------------
+ 
+ See [SECURITY.md](SECURITY.md)