Add security policy profile

Jaime Fournier <jaimef@linbsd.org>

2aeff7cb32eed4690c77ac963f04af0fee8db653

diff --git a/.jerboa/security.json b/.jerboa/security.json
new file mode 100644
index 0000000..6e2e916
--- /dev/null
+++ b/.jerboa/security.json
@@ -0,0 +1,22 @@
+{
+  "version": 1,
+  "repo": "jerboa-dns",
+  "extends": ["jerboa:daemon", "jerboa:ffi", "jerboa:network-service", "jerboa:parser"],
+  "paths": {
+    "production": ["*.ss", "*.sls", "lib/**/*.ss", "lib/**/*.sls", "src/**/*.{ss,sls,c,h}", "static/**/*.{ss,sls,c,h}", "bin/**", "Makefile"],
+    "tests": ["test/**", "tests/**", "**/*-test.ss", "bench/**"],
+    "generated": ["build/**", "dist/**", "target/**", "bench/results/**", "*.so", "*.wpo"],
+    "vendor": ["vendor/**", "third_party/**"],
+    "docs": ["README.md", "docs/**", "*.md", "AGENTS.md"]
+  },
+  "policy": {
+    "failOn": ["critical", "high"],
+    "imports": { "directChezscheme": "allow-in-ffi-boundaries" },
+    "ffi": { "allowed": true, "requireCloseOnExec": true, "requireDynamicWindCleanup": true },
+    "process": { "shellInterpolation": "deny" },
+    "network": { "requireTimeouts": true, "requireFailClosedSandbox": true, "maxReadBytes": 512 },
+    "eval": { "stringEval": "deny", "bareRead": "deny", "allowReadEval": false },
+    "daemon": { "requirePrivilegeDrop": true, "requireSetgroups": true }
+  },
+  "suppressions": []
+}