update security docs

.github/SECURITY.md

@@ -2,6 +2,8 @@
 
 To report a security vulnerability please email security@dataverse.org as explained at https://guides.dataverse.org/en/latest/installation/config.html#reporting-security-issues
 
+We usually give credit to security researchers in our release notes.
+
 Advice on securing your installation can be found at https://guides.dataverse.org/en/latest/installation/config.html#securing-your-installation
 
 Security practices and procedures used by the Dataverse team are described at https://guides.dataverse.org/en/latest/developers/security.html

doc/sphinx-guides/source/developers/making-releases.rst

@@ -96,6 +96,7 @@ The task at or near release time is to collect these snippets into a single file
 - Create a branch, add a .md file for the release (ex. 6.10.1 Release Notes) in ``/doc/release-notes`` and write the release notes, making sure to pull content from the release note snippets mentioned above. Snippets may not include any issue number or pull request number in the text so be sure to copy the number from the filename of the snippet into the final release note.
 - Delete (``git rm``) the release note snippets as the content is added to the main release notes file.
 - Include instructions describing the steps required to upgrade the application from the previous version. These must be customized for release numbers and special circumstances such as changes to metadata blocks and infrastructure. These instructions are required for the next steps (deploying to various environments) so try to prioritize them over finding just the right words in release highlights (which you can do later).
+- We usually include a "Security Updates" section due to dependencies we've updated. Under that section, give credit to any security researchers who have reported vulnerabilities. In the `6.11 release notes <https://github.com/IQSS/dataverse/releases/tag/v6.11>`_, for example, we wrote "We would like to thank [person1], [person2], and [person3] for notifying us about vulnerabilities that were fixed in this release." See :ref:`security-researcher-credit` and :ref:`reporting-security-issues`.
 - Make a pull request. Here's an example: https://github.com/IQSS/dataverse/pull/11613
 - Note that we won't merge the release notes until after we have confirmed that the upgrade instructions are valid by performing a couple upgrades.
 

doc/sphinx-guides/source/developers/security.md

@@ -0,0 +1,31 @@
+# Security
+
+These are security resources for Dataverse developers.
+
+```{contents}
+:local:
+```
+
+## User-Facing Security-Related Documentation
+
+You should familiarize yourself with the following content we provide for our users to read:
+
+- {ref}`ongoing-security`
+- {ref}`security-advisories`
+- {ref}`reporting-security-issues`
+- [SECURITY.md](https://github.com/IQSS/dataverse/blob/develop/.github/SECURITY.md) (rendered for the public at <https://github.com/IQSS/dataverse/security>)
+
+Some information is repeated across these documents and we should keep them in sync.
+
+## Tracking Security Issues
+
+We use a private GitHub issue tracker at <https://github.com/IQSS/dataverse-security/issues> for security issues.
+
+## Sending Security Advisories
+
+See our [how to send a security advisory](https://docs.google.com/document/d/1sYhi-_U1xP2ZEjWtqVqkuuMxncG_VZZYQRKDEv6N-KQ/edit?usp=sharing) doc.
+
+(security-researcher-credit)=
+## Giving Credit to Security Researchers
+
+We usually give credit to security researchers in release notes. See {ref}`write-release-notes` and {ref}`reporting-security-issues`.

doc/sphinx-guides/source/installation/config.rst

@@ -252,16 +252,34 @@ For any resources to be integrated with Dataverse, find documentation how to set
 Ongoing Security of Your Installation
 +++++++++++++++++++++++++++++++++++++
 
-Like any application, you should keep up-to-date with patches to both the Dataverse software and the platform (usually Linux) it runs on. Dataverse releases are announced on the dataverse-community_ mailing list, the Dataverse blog_, and in chat.dataverse.org_.
+New Releases
+^^^^^^^^^^^^
+
+Like any application, you should keep up-to-date with new releases of Dataverse, which often contain security fixes.
+
+Dataverse releases are announced on the dataverse-community_ mailing list, Zulip_, and the Dataverse blog_.
 
 .. _dataverse-community: https://groups.google.com/g/dataverse-community
+.. _Zulip: https://dataverse.zulipchat.com/
 .. _blog: https://dataverse.org/blog
-.. _chat.dataverse.org: https://chat.dataverse.org
 
-In addition to these public channels, you can subscribe to receive security notices via email from the Dataverse team. These notices are sent to the ``contact_email`` in the installation spreadsheet_ and you can open an issue in the dataverse-installations_ repo to add or change the contact email. Security notices are also sent to people and organizations that prefer to remain anonymous. To be added to this private list, please email support@dataverse.org.
+These announcements link to release notes, which can be found on GitHub:
+
+- Backend: https://github.com/IQSS/dataverse/releases
+- Frontend: https://github.com/IQSS/dataverse-frontend/releases
+
+If the release contains a security-related fix, the release notes will mention generically that a fix is included. Some details are provided via private security advisories, described below.
+
+.. _security-advisories:
 
-.. _spreadsheet: https://docs.google.com/spreadsheets/d/1bfsw7gnHlHerLXuk7YprUT68liHfcaMxs1rFciA-mEo/edit#gid=0
-.. _dataverse-installations: https://github.com/IQSS/dataverse-installations
+Security Advisories
+^^^^^^^^^^^^^^^^^^^
+
+We highly recommend signing up to receive security advisories from the Dataverse team. These advisories are not archived publicly because we don't want attackers to use exploits against you. For this reason we also control who is subscribed to the security advisory mailing list.
+
+To subscribe, email support@dataverse.org and ask to be added to the Dataverse security advisory mailing list.
+
+Below you'll see a step called :ref:`map-of-installations` where you can provide a email address we can use to contact you. We typically automatically add this address to the security list but please feel free to reach out early.
 
 For additional details about security practices by the Dataverse team, see the :doc:`/developers/security` section of the Developer Guide.
 
@@ -270,7 +288,7 @@ For additional details about security practices by the Dataverse team, see the :
 Reporting Security Issues
 +++++++++++++++++++++++++
 
-If you have a security issue to report, please email it to security@dataverse.org.
+If you have a security issue to report, please email it to security@dataverse.org. We usually give credit to security researchers in our release notes. We expect security researchers to look for this information in SECURITY.md (:download:`plain-text <../../../../.github/SECURITY.md>`, `HTML <https://github.com/IQSS/dataverse/security>`_) and include it there.
 
 .. _network-ports:
 
@@ -2572,6 +2590,8 @@ One way to submit your sitemap URL to Google is by using their "Search Console"
 
 .. _Google's "submit a sitemap" instructions: https://support.google.com/webmasters/answer/183668
 
+.. _map-of-installations:
+
 Putting Your Dataverse Installation on the Map at dataverse.org
 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++