Add some notes on security

docs/Contribution.md

@@ -3,8 +3,7 @@ Contributing to CivetWeb
 
 Contributions to CivetWeb are welcome, provided all contributions carry the MIT license.
 
-- Please report issues on GitHub. If the issue you want to report is already reported there, add a note
-with your specific details to that issue. In case of doubt, please create a new issue.
+- Please report issues on GitHub. If the issue you want to report is already reported there, add a note with your specific details to that issue. In case of doubt, please create a new issue.
 - If you know how to fix the issue, please create a pull request on GitHub. Please take care your modifications pass the continuous integration checks. These checks are performed automatically when you create a pull request, but it may take some hours until all tests are completed. Please provide a description for every pull request.
 - Alternatively, you can post a patch or describe the required modifications in a GitHub issue.
 However, a pull request would be preferred.
@@ -19,3 +18,6 @@ However, a pull request would be preferred.
   4. have significant influence on maintenance,
   
   please first create an issue on GitHub or create a thread on the CivetWeb discussion group, to discuss the planned changed.
+
+- In case you think you found a security issue that should be evaluated and fixed before public disclosure, feel free to write an email.  Although CivetWeb is a fork from Mongoose from 2013, the code bases are different now, so security vulnerabilities of Mongoose usually do not affect CivetWeb.  Open an issue for Mongoose vulnerabilities you want to have checked if CivetWeb is affected.
+

examples/https/civetweb.conf

@@ -63,7 +63,7 @@ additional_header Public-Key-Pins: pin-sha256="uz1UTAPen+xb+UoQqkVlEx4H653LbMjfR
 # Ratings from 2017-09-03 (tests performed later may require more
 # strict security settings)
 #
-# Headers rated A+ from https://securityheaders.io/ 
+# Headers rated A+ from https://securityheaders.io/
 #
 # SSL rated B from https://www.htbridge.com/ssl when using a self signed
 # certificate, but no other weaknesses for modern browsers.
@@ -78,5 +78,9 @@ additional_header Public-Key-Pins: pin-sha256="uz1UTAPen+xb+UoQqkVlEx4H653LbMjfR
 # A rating of "T / If trust issues are ignored: A" (ignoring self-signed cert)
 # from https://www.ssllabs.com/ssltest/, https://www.qualys.com/forms/freescan/
 # (Note: this test is runs with reverse DNS name, while all others use the
-# IP address). 
+# IP address).
+#
+# Note: This settings are very strict and prevent some older but still common
+# versions of major browsers to access this site. The test web sites will give
+# you an overview. Test, before you use this settings.