Add security policy

[tatiana]

A security policy provides guidelines for evaluating and mitigating security risks.

The idea of a security policy in software is familiar; many large open-source projects understand the need to define policies and procedures for reporting security issues. Some even have dedicated teams to handle security issues. Forges like GitHub actively promote adding a SECURITY.rst or SECURITY.md file in the code repository that explains how to report security issues.

This task aims to add the first version of a security policy for Cosmos, following @chaosmawi's recommendations.

Co-authored-by: Joshua Domagalski [email protected]

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 96.28%. Comparing base (6d4a239) to head (1acfcd1).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1385   +/-   ##
=======================================
  Coverage   96.28%   96.28%           
=======================================
  Files          68       68           
  Lines        4150     4150           
=======================================
  Hits         3996     3996           
  Misses        154      154           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[cloudflare-workers-and-pages]

Deploying astronomer-cosmos with    Cloudflare Pages

Latest commit:	1acfcd1
Status:	✅  Deploy successful!
Preview URL:	https://24bae40a.astronomer-cosmos.pages.dev
Branch Preview URL:	https://add-security-policy.astronomer-cosmos.pages.dev

View logs

[chaosmaw]

@tatiana - I added one comment/recommended change. Otherwise, gtg to me.

[lzdanski]

Copyediting review!

[lzdanski]

@tatiana - I'm happy to re-review if you'd like further copyediting, but I don't want that to block you when you're ready to merge. To a couple of your questions:

• I think that you might be able to remove "response timeframe" entirely if there isn't a policy or compliance reason to have that as a section.
• I did think that Josh's comment had some important nuance we weren't quite getting in the current format, so I edited that section to add his recommendation.
• I'm going to go ahead and approve the PR because my suggestions are pretty minor and I think that you're at a good place to merge as-is, and will still be ok after addressing Jarek's comments.