We should have a vulnerability disclosure program

[AlexxNica]

What is the idea?

Create a vulnerability disclosure program (VDP) for the Protocol Labs Network. That way, security researchers can engage with PLN and teams in a secure and straightforward manner, following best practices and the preferred disclosure process for the organization.

The initial scope is to have a VDP focused on PLN's infrastructure, but we could also expand that to include offerings to handle security operations for member teams and companies in the future.

Why is this important?

We currently don't have a place that documents our policies and guidelines regarding vulnerability disclosures. Having a vulnerability disclosure program would increase confidence among the hacking community and security researchers around our security stance and methods of communication.