Add SECURITY.md

.github/workflows/config/spellcheck_config.yml

@@ -39,6 +39,9 @@ matrix:
       - open: '([A-Za-z_\\\/]+\.)+'
         close: '($|(?=[^a-z]))'
         content: '\S+?'
+      # Ignore email addresses
+      - open: '\b[A-Za-z0-9._%+-]+@'
+        close: '[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b'
 
 - name: rst
   sources:

.github/workflows/config/spelling_allowlist.txt

@@ -59,6 +59,7 @@ OpenQASM
 OpenSSL
 OpenSUSE
 POSIX
+PSIRT
 Pauli
 Paulis
 PyPI
@@ -88,6 +89,7 @@ VQE
 Vazirani
 WSL
 accessor
+acknowledgement
 adjoint
 al
 ansatz

SECURITY.md

@@ -0,0 +1,34 @@
+# Security
+
+NVIDIA is dedicated to the security and trust of our software products and
+services, including all source code repositories managed through our
+organization.
+
+If you need to report a security issue, please use the appropriate contact points
+outlined below. **Please do not report security vulnerabilities through GitHub.**
+
+## Reporting Potential Security Vulnerability in an NVIDIA Product
+
+To report a potential security vulnerability in any NVIDIA product:
+
+- Web: [Security Vulnerability Submission Form](https://www.nvidia.com/object/submit-security-vulnerability.html)
+- E-Mail: <[email protected]>
+  - We encourage you to use the following PGP key for secure email communication:
+    [NVIDIA public PGP Key for communication](https://www.nvidia.com/en-us/security/pgp-key)
+  - Please include the following information:
+  - Product/Driver name and version/branch that contains the vulnerability
+  - Type of vulnerability (code execution, denial of service, buffer overflow, etc.)
+  - Instructions to reproduce the vulnerability
+  - Proof-of-concept or exploit code
+  - Potential impact of the vulnerability, including how an attacker could
+    exploit the vulnerability
+
+While NVIDIA currently does not have a bug bounty program, we do offer
+acknowledgement when an externally reported security issue is addressed under
+our coordinated vulnerability disclosure policy. Please visit our
+[Product Security Incident Response Team (PSIRT)](https://www.nvidia.com/en-us/security/psirt-policies/)
+policies page for more information.
+
+## NVIDIA Product Security
+
+For all security-related concerns, please visit [NVIDIA's Product Security portal](https://www.nvidia.com/en-us/security).