Add SAFE security review of erlef/oidcc

reviews/github/erlef/oidcc/2024-04-03-safe.md

@@ -0,0 +1,54 @@
+---
+Publication-State: Active
+Access: Public
+Reviewers:
+- Associated-With-Project: False
+  Compensation-Source: External
+Domain: Security
+Methodology:
+- Static-Analysis
+- Dynamic-Analysis
+- External-Review
+Issues-Identified: Non-Severe
+Package-URLs:
+- pkg:hex/oidcc@3.1.2
+Review-Date: 2024-04-03
+Scope: Implementation/Full
+Schema-Version: 1.0
+SPDX-License-Identifier: CC-BY-4.0
+---
+
+### Summary
+
+Our audit used Static Analysis with Data flow and control flow analysis.
+The OIDCC Erlang code is secure ✅
+
+### Details
+
+The review found a low severity atom exhaustion vulnerability (CVE-2024-31209). The vulnerability has been patched & released.
+
+### Methodology
+
+Static Analysis with Data flow and control flow analysis
+
+https://eltesoft.hu/en/safe-project/
+
+### External References
+
+* https://eltesoft.hu/en/safe-project/
+* https://www.erlang-solutions.com/blog/erlang-security-audit/
+* https://www.erlang-solutions.com/landings/security-audit-for-erlang-2/
+* https://github.com/erlef/oidcc/security/advisories/GHSA-mj35-2rgf-cv8p
+
+### Disclaimer
+
+All security reviews are conducted on a "best-effort" basis against a software
+component at a point in time. We make no guarantee as to the quality or completeness
+of any review. If you believe any content is inaccurate, we encourage you to open
+an issue or submit a pull request with a correction or improvement.
+
+### License
+
+This text is released under at least the
+[Creative Commons Attribution 4.0 (CC-BY-4.0) license](https://creativecommons.org/licenses/by/4.0/legalcode.txt).
+Externally-referenced content may be licensed differently.