Speaking from experience with other DNS projects, you might want to mention e.g.:

• if it affects multiple implementations tell us upfront - it requires multi-party coordination and sometimes reporters kinda forget to mention it unless asked explicitly
• maybe you will want to have some statue of limitations, documented security assumptions etc. as an example see https://bind9.readthedocs.io/en/latest/chapter7.html

For starters, I'm not sure if DNSSEC validation and related features are fully supported (in the political sense) and if misvalidations should be reported as security bugs.

I'm not sure if DNSSEC validation and related features are fully supported

This is currently true, but we are going to be getting better here, so it's worth having a statement on it. I think the bigger question is on response time. I don't thin we are able to guarantee a rapid response to security issues in general, and DNSSEC is more complex than most other issues and could require longer turn around to fix.

I'm not sure if DNSSEC validation and related features are fully supported

This is currently true, but we are going to be getting better here, so it's worth having a statement on it. I think the bigger question is on response time. I don't thin we are able to guarantee a rapid response to security issues in general, and DNSSEC is more complex than most other issues and could require longer turn around to fix.

I think the only definite time frames should be acknowledgement and initial response time frames - which could be several days (Node, for instance, has a 5 day response time,) with a time frame to deliver a fix and coordinate disclosure with the researcher to be worked out on a case-by-case basis.

Maybe something like this:

Please report vulnerabilities via GitHub security advisories. The Hickory DNS team will make every effort to respond to vulnerability disclosures within 96 hours. After initial triage, we will work with the reporting researcher on a disclosure time-frame and mutually agreeable embargo date, taking into account the work needed to:

• Identify affected versions
• Develop and test appropriate fix(es)
• Coordinate response with other DNS vendors (if necessary.)

@bluejekyll feel free to take over this branch, I'm not sure I will have much time to work on it.