Clarify policy on when a bug is considered a security issue

[kevinbackhouse]

I received a couple of bug reports recently that can only be triggered via our fuzzing target or via one of the "samples" applications. So I think that we should clarify the security policy to say that only bugs that can be triggered from the exiv2 command line are potential security vulnerabilities.

[codecov]

Codecov Report

Merging #2038 (5290479) into main (d508e09) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #2038   +/-   ##
=======================================
  Coverage   61.38%   61.38%           
=======================================
  Files          96       96           
  Lines       19214    19214           
  Branches     9852     9852           
=======================================
  Hits        11794    11794           
  Misses       5096     5096           
  Partials     2324     2324           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d508e09...5290479. Read the comment docs.

[clanmills]

Can we refine this a little @kevinbackhouse.

Two scenarios in which we should treat an issue with a sample as a security vulnerablibilty:

1. If the sample application reveals a solid issue in the library, we should accept that as equivalent to an issue revealed by the exiv2 command-line program.

2. If the sample application has a security issue with a genuine user file, that should also be treated as a high priority.

A scenario in which we should NOT treat a sample issue as a security risk:

1. If there's a bug in a sample application that requires special input files and/or special build settings, that should be treated as a regular issues. Sample applications are provided to demonstrate the use of the API and should never be deployed for production use.

[kevinbackhouse]

@clanmills: Thanks for the suggestions. I have updated the text.

[clanmills]

Very well written.