Create SECURITY.md

[Gkjsdll]

Fred in HR told me we needed this?!? I had to pull 3 all nighters & involve 5 teams to get this done by the deadline. .. Edits are disabled because this was rush-approved by B2B cloud enterprise blockchain security division, and they cannot budget time to review any edits.

[Tylersuard]

@Gkjsdll I was in that meeting with Fred, he said this was due on 5/28 and not 4/28. I'm glad you got this done under the deadline though. As a reward, we are assigning you more work.

[mscottnelson]

Unfortunately, the release window for these changes has expired. During that time, the security landscape has changed considerably.

Please consider resubmitting this PR after obtaining pre-approval from the new InfraStructureAsCode Security Review Committee as per the email sent out in early June, and resubmitting...this time to the appropriate closed-source-for-security branch of the project.

Note that since your PR contains sensitive security related information and you did not submit to the appropriate branch or obtain all necessary approvals, your submission has been flagged and all future PRs will require additional review by the appropriate security team.

Please refer to the security policy documents for more information about related additional monitoring of your hardware and online activity for this breach of protocol.

[Spookerton]

Hi there! My team leader has been referring to the document added here extensively in our daily scrums but the internal KB has no such material or references; I spent a couple of evenings chasing this down because I am currently involved with handing dependency upgrades for an internal project. Some key thoughts:

1. Fred left the company in late 22. I cannot find anything in our KB (as I mentioned) relating to these practices, so this may be the only paid work done to meet the original mentioned goals.
2. The mentioned committee was disbanded as part of lean measures re- recent geo events. As far as I can tell most work was done over skype??
3. Because we use this platform, this file is now expected to exist in docs/ or .platform/ (maybe both? Platform document mentions both but does not discuss precedence)

I know this is a stale issue but feedback via direct email response would be very welcome

[Spookerton]

Thanks for the mail chain this morning - got that all sorted out.

[oscrx]

Citrix is not an approved tool. This is obviously not enterprise quality!!!

[vlandemart]

Bit of issues with formatting

[vlandemart]

Let's write "MacOS" starting with capital letter, like everywhere else in project.

[sasdallas]

Let's write "MacOS" starting with capital letter, like everywhere else in project.

Why not Mac OS X?

[sasdallas]

Hi all,

I believe that we should also approve Windows WordPad as a development environment. It would likely be the best choice for all very serious development

As well as that, I suggest also adding very threatening legal text to the security file if the closed source branch is leaked.