docs: add security page (#4922)

.github/workflows/release.yml

@@ -62,8 +62,8 @@ jobs:
             + `\n`
             + `## Security\n`
             + `\n`
-            + `Binaries have been produced by the [Release workflow](https://github.com/${owner}/${repo}/actions/workflows/release.yml)`
+            + `Binaries are compiled from source through the [Release workflow](https://github.com/${owner}/${repo}/actions/workflows/release.yml) without human intervention,`
-            + ` without human intervention.\n`
+            + ` preventing any external interference.`
             + `\n`
             + 'You can verify that binaries have been produced by the workflow by using [GitHub Attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds):\n'
             + `\n`

SECURITY.md

@@ -1,3 +1,3 @@
-# Security Policy
+# Security
 
-Vulnerabilities can be reported privately by using the [Security Advisory](https://github.com/bluenviron/mediamtx/security/advisories/new) feature of GitHub.
+Check the [Security page](https://mediamtx.org/docs/other/security) on the website.

docs/4-other/3-security.md

@@ -0,0 +1,21 @@
+# Security
+
+## Reporting vulnerabilities
+
+Vulnerabilities can be reported privately by using the [Security Advisory](https://github.com/bluenviron/mediamtx/security/advisories/new) feature of GitHub.
+
+## Binaries
+
+Binaries are compiled from source through the [Release workflow](https://github.com/bluenviron/mediamtx/actions/workflows/release.yml) without human intervention, preventing any external interference.
+
+You can verify that binaries have been produced by the workflow by using [GitHub Attestations](https://docs.github.com/en/actions/security-for-github-actions/using-artifact-attestations/using-artifact-attestations-to-establish-provenance-for-builds):
+
+```sh
+ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
+```
+
+You can verify the binaries checksum by downloading `checksums.sha256` and running:
+
+```sh
+cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
+```