[website] Added security vulnerability disclosure page

website/extra/htaccess

@@ -24,6 +24,10 @@ RewriteRule ^disable-checked-exceptions$ /disable-checked-exceptions.html [L,END
 RewriteRule ^disable-checked-exceptions(\.html)?/?$ /disable-checked-exceptions [NC,R=301]
 RewriteRule ^supporters$ /supporters.html [L,END]
 RewriteRule ^supporters(.html)?/?$ /supporters [NC,R=301]
+RewriteRule ^security$ /security.html [L,END]
+RewriteRule ^security(.html)?/?$ /security [NC,R=301]
+RewriteRule ^contact$ /contact.html [L,END]
+RewriteRule ^contact(.html)?/?$ /contact [NC,R=301]
 RewriteRule ^order-license-info$ /order-license-info.html [L,END]
 RewriteRule ^order-?license-?info(.html)?/?$ /order-license-info [NC,R=301]
 RewriteRule ^order-license$ /order-license.html [L,END]

website/resources/.well-known/security.txt

@@ -0,0 +1,4 @@
+Contact: https://tidelift.com/security
+Contact: mailto:info@projectlombok.org
+
+# If encrypted communication is required, let us know and we'll provide a public GPG key.

website/resources/js/supporters.js

@@ -214,7 +214,7 @@
 		});
 		if (s.children().length < 1) {
 			var x = $("<div />").addClass("noSupportersBox").html(
-				"We don't have any supporters yet this month.<br /><a href=\"https://patreon.com/lombok\" rel=\"noopener\">Become a patron</a> " +
+				"We don't have any supporters yet this month.<br /><a href=\"https://patreon.com/lombok\">Become a patron</a> " +
 				"or <a href=\"/order-license-info\">order a professional or enterprise license</a> today!");
 			s.append(x);
 		}

website/templates/_scaffold.html

@@ -100,9 +100,10 @@ ga('send', 'pageview');
 						<li class="dropdown">
 							<a class="dropdown-toggle pointer" data-toggle="dropdown">Community<span class="caret"></span></a>
 							<ul class="dropdown-menu" aria-labelledby="themes">
-								<li><a href="https://groups.google.com/group/project-lombok" rel="noopener">Discuss / Help</a></li>
-								<li><a href="https://github.com/rzwitserloot/lombok/issues" rel="noopener">Issues</a></li>
+								<li><a href="https://groups.google.com/group/project-lombok">Discuss / Help</a></li>
+								<li><a href="https://github.com/rzwitserloot/lombok/issues">Issues</a></li>
 								<li><a href="/contributing/index">Documentation for contributors</a></li>
+								<li><a href="/contact">Contact the team behind Project Lombok</a></li>
 							</ul>
 						</li>
 						<li>

website/templates/contact.html

@@ -0,0 +1,19 @@
+<#import "/_scaffold.html" as main>
+<@main.scaffold title="Contacting the team behind Project Lombok">
+	<div class="page-header top5">
+		<div>
+			<div class="row">
+				<p>
+					Project Lombok is an open source project, maintained primarily by Roel Spilker and Reinier Zwitserloot. We have day jobs and don't get paid much for Project Lombok's maintenance. Please keep this in mind when contacting us; we're doing it out of love.
+				</p><p>
+					To contact us, <ul>
+						<li>There's a <a href="https://groups.google.com/group/project-lombok">forum</a>; we read and respond here.</li>
+						<li>If you have a feature request or bug report, please file it on our <a href="https://github.com/rzwitserloot/lombok/issues">github bug tracker</a>.</li>
+						<li>If you have a security vulnerability to report, please contact us via our <a href="/security">security vulnerability disclosure</a> page.</li>
+						<li>We love giving presentations, about lombok, or even just general java things. <a href="mailto:info@projectlombok.org">Send us a mail</a> if you want to invite us to do a talk.</li>
+					</ul>
+				</p>
+			</div>
+		</div>
+	</div>
+</@main.scaffold>

website/templates/contributing/index.html

@@ -13,5 +13,8 @@
 				Discusses how lombok ends up being invoked, and how it gets around to transforming code being compiled / edited.
 			</@main.feature>
 		</div>
+		<div class="row">
+			More documentation can be found on the <a href="https://github.com/rzwitserloot/lombok/wiki">project lombok github wiki</a>.
+		</div>
 	</div>
 </@main.scaffold>

website/templates/security.html

@@ -0,0 +1,18 @@
+<#import "/_scaffold.html" as main>
+<@main.scaffold title="Security Vulnerabilities">
+	<div class="page-header top5">
+		<div>
+			<div class="row">
+				<p>
+					Lombok is a build-time only dependency; there is no need for <code>lombok.jar</code> to be available when your application is run, it just needs to be there when you compile your code.
+				</p><p>
+					Therefore, lombok is highly unlikely to be a source of security vulnerabilities.
+				</p><p>
+					Nevertheless, if you have a concern or found a vulnerability, please disclose the vulnerability privately. We would like to coordinate with you so that we can release a fix for the vulnerability together with the disclosure of the vulnerability to the public. As an open source project we are not currently able to offer a monetary reward, but we will acknowledge your contribution (and we'll owe you a refreshing beverage of your choice, of course!), and work with you to set a reasonable timeline for a fix.
+				</p><p>
+					If you want to report a vulnerability, please contact the <a href="https://tidelift.com/security">tidelift security team</a>. Alternatively, you can contact us directly via <a href="mailto:info@projectlombok.org">info@projectlombok.org</a>.
+				</p>
+			</div>
+		</div>
+	</div>
+</@main.scaffold>