Responsible disclosure request

[drakes00]

Dear maintainers,

I am part of a cybersecurity team of University of Clermont-Ferrand, France (LIMOS laboratory), and we analyzed the security of the SRP.
We found multiple vulnerabilities in the protocol and successfully tested them on your crate.

In a process of responsible disclosure, I'd like to share them with you before we attempt to publish our findings.

Would you like to either share a contact email or contact me directly at my own address: Maxime (dot) Puys (at) uca (dot) fr

Looking forward to discussing with you,
Best,

[tarcieri]

It seems this repo was lacking our standard SECURITY.md. I went ahead and added it in #253. You can disclose issues at: https://github.com/RustCrypto/PAKEs/security/advisories/new

Note that there have been several recent changes to this crate including fixes for security issues (#191) which involved a wholesale replacement of num-bigint with crypto-bigint, so you may want to reconfirm which of your findings are still applicable to srp v0.7.0-rc.0.