Add a `SECURITY.md` in every public repo

[jameslamb]

Description

GitHub has special handling of a root-level file named SECURITY.md. From https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/adding-a-security-policy-to-your-repository

give instructions for how to report a security vulnerability in your project by adding a security policy to your repository

This tracks the work of adding a file like that to every RAPIDS repo.

Benefits of this work

Why not just use an org-wide default file?

For a few years, we've had a default org-wide file with that information at https://github.com/rapidsai/.github/blob/e9b5cddd57020c5dc4f88bf8fa62fc7eaaf3ef13/SECURITY.md.

That's helpful! It by default populates the "security policy" link displayed on project homepages:

ref: https://github.com/rapidsai/cudf?tab=security-ov-file#readme

But adding actual files to each repo adds some benefits:

• ensures security policy travels with the repo to forks, clones, mirrors, etc.
• allows per-repo governance over the security policy (via PR review, CODEOWNERS, etc.)

Acceptance Criteria

• every public RAPIDS repo has an up-to-date SECURITY.md describing how to report security issues
• repo-wide default security policy is up to date

Approach

• update the org-wide default one at https://github.com/rapidsai/.github/blob/e9b5cddd57020c5dc4f88bf8fa62fc7eaaf3ef13/SECURITY.md
• enable private vulnerability reporting (GitHub docs) in every repo

Then update all the others (rapids-reviser can help):

• build-metrics-reporter (add PR CI, pre-commit, other maintenance machinery build-metrics-reporter#7)
• build-planning (Add SECURITY.md #283)
• ci-imgs (Add SECURITY.md ci-imgs#410)
• cucim (Add SECURITY.md cucim#1093)
• cudf (Add SECURITY.md cudf#22684)
• cugraph (Add SECURITY.md cugraph#5530)
• cugraph-docs (Add SECURITY.md cugraph-docs#197)
• cugraph-gnn (Add SECURITY.md cugraph-gnn#467)
• cuml (Add SECURITY.md cuml#8175)
• cuopt (skills: prep for nvidia/skills catalog onboarding NVIDIA/cuopt#1310)
• cuvs (Add SECURITY.md cuvs#2139)
• cuvs-lucene (Add SECURITY.md cuvs-lucene#154)
• cuxfilter (Add SECURITY.md cuxfilter#785)
• dask-cuda (Add SECURITY.md dask-cuda#1653)
• dask-upstream-testing (Add SECURITY.md dask-upstream-testing#103)
• dependency-file-generator (chore(docs): Add SECURITY.md dependency-file-generator#181)
• deployment (Add SECURITY.md deployment#688)
• detect-weak-linking (Add SECURITY.md, default codeowners detect-weak-linking#9)
• devcontainers (Add SECURITY.md devcontainers#713)
• docker (Add SECURITY.md docker#883)
• docs (Add SECURITY.md docs#788)
• gha-tools (Add SECURITY.md gha-tools#259)
• gpu-bdb (Add SECURITY.md gpu-bdb#275)
• gputreeshap (Add SECURITY.md gputreeshap#70)
• gqe (Add a SECURITY.md in every public repo #281 (comment))
• gqe-bench (Add a SECURITY.md in every public repo #281 (comment))
• integration (Add SECURITY.md integration#845)
• kvikio (Add SECURITY.md kvikio#969)
• legate-boost (Add SECURITY.md, default codeowners legate-boost#264)
• legate-dataframe (Add SECURITY.md legate-dataframe#170)
• multi-gpu-tools (Add SECURITY.md multi-gpu-tools#37)
• node (Add SECURITY.md node#487)
• nvforest (Add SECURITY.md nvforest#134)
• nx-cugraph (Add SECURITY.md nx-cugraph#263)
• pre-commit-hooks (Add SECURITY.md pre-commit-hooks#126)
• raft (Add SECURITY.md raft#3044)
• rapids.ai (Add SECURITY.md rapids.ai#479)
• rapids-build-backend (Add SECURITY.md rapids-build-backend#81)
• rapids-cli (Add SECURITY.md rapids-cli#151)
• rapids-cmake (Add SECURITY.md rapids-cmake#1033)
• rapids-dask-dependency (Add SECURITY.md rapids-dask-dependency#155)
• rapids-examples (Add SECURITY.md, default codeowners rapids-examples#64)
• rapids-logger (Add SECURITY.md rapids-logger#75)
• rapids-metadata (Add SECURITY.md rapids-metadata#76)
• rapids-triton (Add SECURITY.md, default codeowners rapids-triton#38)
• rapidsmpf (Add SECURITY.md rapidsmpf#1064)
• rmm (add SECURITY.md rmm#2419)
• rvc (Add SECURITY.md rvc#19)
• shared-actions (Add SECURITY.md shared-actions#112)
• shared-workflows (Add SECURITY.md shared-workflows#559)
• spdx-license-builder (Add SECURITY.md spdx-license-builder#8)
• sphinx-theme (Add SECURITY.md, default codeowners sphinx-theme#4)
• ucx-wheels (Add SECURITY.md ucx-wheels#34)
• ucxx (Add SECURITY.md ucxx#665)
• velox-testing (Add SECURITY.md velox-testing#354)
• workflows (Add SECURITY.md workflows#117)

Notes

N/A