Add SECURITY.md

.circleci/config.yml

@@ -2,7 +2,7 @@ version: 2
 jobs:
   test:
     docker:
-      - image: circleci/node:12.9.1-stretch
+      - image: cimg/python:3.9-node
     steps:
       - checkout
       - run:

LOCALIZATION.md

@@ -6,13 +6,7 @@ Providing localization in many languages is a challenge, and automatic translati
 
 ## Contributing Localizations
 
-#### Option 1: Suggest Changes
-
-From within Mailspring, choose "Developer > Toggle Localizer Tools" from the menu. A yellow bar appears at the bottom of the window. From here, you can use the small "Inspect" button to click text in the window which is untranslated or poorly translated. Type a new translation and click "Submit"!
-
-_Note: These translations are reviewed manually and a Mailspring maintainer will change the necessary files._
-
-#### Option 2: Submit a Pull Request
+#### Submit a Pull Request
 
 If you have a GitHub account, you can improve the localization files directly and submit a Pull Request! If you're interested in providing many translations, or translating things like network error messages you may not ever see yourself, this is the best bet. It also means you'll be recognized as a Mailspring contributor and the Mailspring project will appear on your GitHub profile!
 

SECURITY.md

@@ -0,0 +1,9 @@
+# Security
+
+Mailspring takes the privacy of your data seriously. When you connect email accounts to the app, your email credentials are stored securely in your system keychain. Mailspring does not transmit, store or process your mail in the cloud. For more information about how we protect and handle your data, take a look at the [Privacy Policy](https://getmailspring.com/privacy-policy). We've written up a detailed [breakdown of the information](https://foundry376.zendesk.com/hc/en-us/articles/360002704911-What-data-does-Mailspring-collect-when-I-use-the-product-) that Mailspring stores in the cloud, and we allow you to [delete it all](https://foundry376.zendesk.com/hc/en-us/articles/115001994551-How-do-I-delete-my-Mailspring-ID-and-all-data-stored-on-Mailspring-servers-GDPR-) in compliance with GDPR.
+
+When you set up the app you can also choose to skip "Mailspring ID" setup, which opts you out of our cloud features and prevents your data from being transmitted off your machine entirely.
+
+## Responsible Disclosure
+
+If you have reason to believe that Mailspring is subject to a security vulnerability or breach, or believe a third-party or unofficial download site is hosting malware under the Mailspring name, please email our team at [security@foundry376.com](mailto:security@foundry376.com) with as much information as you can provide. You can expect a response within a day.