A security policy (SECURITY.md) explains how the project wishes to receive and handle responsible disclosure of potential vulnerabilities. [GitHub recommends](https://docs.github.com/en/code-security/getting-started/securing-your-repository#setting-a-security-policy) that projects have one.

The security policy can be found by users who enter the project's "Security" panel. They'll also see references to it in the "New issue" page.

There are two main ways to receive disclosures:
- register an email or website available to receive such reports; and/or
- use [GitHub's private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository)

If you want to use GitHub's reporting system, it must be activated for the repository:
1. Open the repo's settings
2. Click on [Code security & analysis](https://github.com/WebAssembly/wabt/settings/security_analysis)
3. Click "Enable" for "Private vulnerability reporting"

I'll send a PR with a draft policy along with this issue.

Alternatively, the policy can be created in the [WebAssembly/.github](https://github.com/WebAssembly/.github) repository. In this case, the policy will be available in all of the org's repos.

---

**Disclosure:** My name is Pedro and I work with Google and the [Open Source Security Foundation (OpenSSF)](https://www.openssf.org/) to improve the supply-chain security of the open-source ecosystem.
Add a security policy
This is a GitHub Issue
repo:wabt
owner:WebAssembly
Title : Add a security policy
Issue date:

--- start body ---
A security policy (SECURITY.md) explains how the project wishes to receive and handle responsible disclosure of potential vulnerabilities. [GitHub recommends](https://docs.github.com/en/code-security/getting-started/securing-your-repository#setting-a-security-policy) that projects have one.

The security policy can be found by users who enter the project's "Security" panel. They'll also see references to it in the "New issue" page.

There are two main ways to receive disclosures:
- register an email or website available to receive such reports; and/or
- use [GitHub's private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository)

If you want to use GitHub's reporting system, it must be activated for the repository:
1. Open the repo's settings
2. Click on [Code security & analysis](https://github.com/WebAssembly/wabt/settings/security_analysis)
3. Click "Enable" for "Private vulnerability reporting"

I'll send a PR with a draft policy along with this issue.

Alternatively, the policy can be created in the [WebAssembly/.github](https://github.com/WebAssembly/.github) repository. In this case, the policy will be available in all of the org's repos.

---

**Disclosure:** My name is Pedro and I work with Google and the [Open Source Security Foundation (OpenSSF)](https://www.openssf.org/) to improve the supply-chain security of the open-source ecosystem.
--- end body ---
