Thanks for this!

We've never had a security policy before because it didn't seem relevant - we're a purely python project, and all file or network IO is done through third party libraries. It seems likely that any vulnerabilities reported to us would actually come from our dependencies, and we'd end up fielding reports that we really shouldn't be. (This is just a guess, but we do get this kind of thing quite often for general bugs.)

Do you have a sense of what could go in such a document in our case?

Thank you for for your answer @bmcfee! I believe that your response makes sense :)

I really don't have the expertise on the subject to provide recommendations on this policy. I'm sorry :(

Ok, well let's leave this issue up as a placeholder in case anyone with security know-how wants to take it on.

Alternatively, it might be useful to see what comparable "mid-level" python packages (i.e., pure python and above the numpy/scipy/matplotlib stack) do for this sort of thing.