Efcore: Update to security template

[smitpatel]

So behind the scene something added a new commit https://github.com/dotnet/efcore/commit/659ecfd2842cb6710d40ecf39f671c28b437fc4f

(tell me more about automation taking over the world!)

Anyway, looking at aspnetcore repo the details have changed a little https://github.com/dotnet/aspnetcore/pull/19236
Our repo does not have security.MD in repo root, rather it is inside .github folder.

• Which one do we keep?
• Make sure the one we keep is up-to-date.

[ajcvickers]

@Pilchie We would like to understand:

• What happened here that resulted in a bot adding a file to the repo without any PR or sign-off
• What the guidance is for security.md especially given that we now have two files in two locations with conflicting information.

[Pilchie]

I'm not sure what this is. @mmitche do you know?

[mmitche]

@terrajobst did this as a project for Barry

[ajcvickers]

@terrajobst Ping.

[ajcvickers]

@terrajobst Ping.

[terrajobst]

• What happened here that resulted in a bot adding a file to the repo without any PR or sign-off

I've sent you an email with the details

• What the guidance is for security.md especially given that we now have two files in two locations with conflicting information.

That I don't know. @blowdart needs to answer how he sees SECURTY.md vs. docs/security.md.

[blowdart]

Its your choice really, as long as all the info is there, including the bug bounty link then I'm good.

[ajcvickers]

@smitpatel Do you want to clean this up?

[smitpatel]

Yes, I do.