README: add bug-submitting instructions
MODIFY
README.md
README.md
@@ -103,6 +103,14 @@ r.global === this; // false
r.global.JSON === JSON; // true
```
+
+## Bug Disclosure
+
+Please help us practice coordinated security bug disclosure. If you find a security-sensitive bug that should not be revealed publically until a fix is available, please send email to `security` at (@) `agoric.com`. To encrypt, please use my (@warner) personal GPG key [A476E2E6 11880C98 5B3C3A39 0386E81B 11CAA07A](http://www.lothar.com/warner-gpg.html) . Keybase users can also send messages to `@agoric_security`, or share code and other log files via the Keybase encrypted file system (`/keybase/private/agoric_security,$YOURNAME`). We will create a github security advisory and add you to the collaborator list.
+
+For non-security bugs, use the
+[regular Issues page](https://github.com/Agoric/realms-shim/issues).
+
[circleci-svg]: https://circleci.com/gh/Agoric/realms-shim.svg?style=svg
[circleci-url]: https://circleci.com/gh/Agoric/realms-shim
[coveralls-svg]: https://coveralls.io/repos/github/Agoric/realms-shim/badge.svg

README: add bug-submitting instructions