we need a security policy

[chadwhitacre]

http://news.ycombinator.com/item?id=5141299

do sec people inherently know to try hitting /security.html by convention, or should there be links to it from the main site?

They know to look for a link to the security page.
Github's is in their site footer.
37signals' is in their site footer.
Twitter's is linked off the sidebar in their "About" page.
Google's and Facebook's are the top search result for their site and "vulnerability" "security".
These are all fine options.

[sigmavirus24]

I would put it in the site footer so it is available everywhere.

[patcon]

Reopening this for #2072 (comment)

cc: @greggles

[patcon]

Convo with @clone1018 on internal password policies: IRC

[rummik]

+1-ing this so it doesn't get lost in my GitHub notifications. Security acknowledgements are good, but both that and policy is better