From 97a2dc75838f19a5fd63dc3f8e3f57e0c4c8cfe6 Mon Sep 17 00:00:00 2001
From: "Carol (Nichols || Goulding)"
 <193874+carols10cents@users.noreply.github.com>
Date: Tue, 9 Jul 2024 20:54:53 -0400
Subject: [PATCH] Add some FAQ entries linking to security policies (#2010)

---
 CONTRIBUTING.md | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index ab77c8633..e98aa477c 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -69,6 +69,19 @@ A: We do not presently handle embargoed vulnerabilities. Please ensure embargoes
    have been lifted and details have been disclosed to the public prior to filing
    them against RustSec.
 
+**Q: Is this where I report a vulnerability in `rustc`?**
+
+A: No, for official Rust projects, please see the [Rust Security Policy](https://www.rust-lang.org/policies/security) and follow the guidelines there.
+
+**Q: Is this where I report intentionally malicious code or malware present on crates.io?**
+
+A: No, please see the [Crates.io Security Policy](https://crates.io/policies/security) to get content violating crates.io's policies taken down.
+
+**Q: I'm a crate author and someone reported a vulnerability in my crate to me. Can you help me?**
+
+A: The Rust Foundation has resources that can help handle Rust ecosystem security issues.
+Please see the [Ecosystem security help for crate authors](https://crates.io/policies/security#ecosystem-security-help) section of the crates.io security policy.
+
 [Pull Request]: https://github.com/RustSec/advisory-db/pulls
 [TOML advisory template]: https://github.com/RustSec/advisory-db#advisory-format
 [Yank]: https://doc.rust-lang.org/cargo/commands/cargo-yank.html