[dlglin]

Here is the first draft of a security policy, written with assistance from Microsoft Copilot.

Once this is finalized it should be ported to the PG repo as well.

[somiaj]

Would it be worth adding a comment that security fixes will be applied to main (current release), and it is the responsibility of server administrators to keep things up to date?

[drgrice1]

I think the wording is generally good, and I think everything is said that needs to be.

Wrap the text to 120 characters as @somiaj said. 120 characaters has been the standard for markdown files in the repository.

[drgrice1]

By the way, thanks for creating this. I think it is going to help to cut down on the headaches of these "security researchers" contacting us out of the blue.

Also, in addition to adding this to the PG repository as well, perhaps this should be a hotfix. The main branch is probably where everyone is going to look for this. So if it is only in the develop branch, it may not help until the next release when it goes into the main branch. This is certainly different than the usual hotfixes that are actually fixing code!