Track adoption of potential OpenJSF Security Program

The OpenJS Foundation (OpenJSF) (and previously Node.js Foundation) has indicated plans of creating a new security program for the Node.js ecosystem, scoped more narrowly to the OpenJSF projects.

The previous Node.js Third-Party Ecosystem Security Program that was managed by the Node.js Security Working Group was scoped to:

• Managed a HackerOne Program with bounties for select NPM packages
• Managed a vulnerability database for NPM packages (initially donated by NSP)

Although it's not clear at this moment what this new program would entail, it seems like it might be a lift-and-shift, but with a focus on OpenJSF projects.

This issue is to track this work of the OpenJSF and to hold discussions on its applicability to LoopBack.

see: https://github.com/openjs-foundation/cross-project-council/issues/826#issuecomment-1077764219
see: https://github.com/nodejs/security-wg/issues/662#issuecomment-637623656
see: https://github.com/nodejs/security-wg/issues/494#issuecomment-780019393
see: https://github.com/nexB/vulnerablecode/issues/488#issuecomment-868489895

Comienza leyendo el issue enlazado del OpenJS Foundation cross-project-council y los issues del Node.js Security Working Group citados en la descripción. Compara el programa propuesto con el alcance anterior de la base de datos de vulnerabilidades de HackerOne y NPM, y documenta después si se aplica a LoopBack y cómo, una vez que los planes de OpenJSF estén claros.