Prepare for public release on Gitea: simurgarray package names, community files, Gitea templates, pseudonymised P6 probe names

SECURITY.md

@@ -0,0 +1,33 @@
+# Security policy
+
+## Supported versions
+
+Security fixes go into the latest release. Older releases are not patched; upgrade to the newest version.
+
+## Reporting a vulnerability
+
+Please do not open a public issue for a security problem. Contact the maintainer privately through the contact
+details on the maintainer's profile page, https://gitea.yaylali.uk/kemal, and include:
+
+* the SimurgArray version (`simurg --version`),
+* what an attacker could do and under which conditions,
+* the smallest input or command that shows the problem, without real genetic data.
+
+You will get an answer within a week. Once a fix is released, the report is credited in `CHANGELOG.md` unless you
+prefer otherwise.
+
+## What counts
+
+SimurgArray reads files that users download from third parties. Problems worth reporting include:
+
+* crafted IDAT, BPM, CSV, EGT, GTC, VCF or sample sheet files that crash the reader in an unsafe way, write outside
+  the output folder, or execute code;
+* HTML reports that run script from their input data (reports are meant to be safe to open and share);
+* anything that could leak sample sheet metadata or genetic data beyond what the user chose to include.
+
+## Handling genetic data
+
+Genotype data are personal data. SimurgArray never sends data anywhere: it has no network access at run time and
+its reports embed everything they need. Users are responsible for storing and sharing outputs according to their
+consent and data protection rules. The QC report offers `--no-metadata`, `--drop-metadata` and `--keep-metadata` to
+control what it contains.