Please move your security policy into the root dir and include it with the distribution

[robrwo]

The security policy is in the .github directory which is useful for people working with the git repo, but it is not obvious that it is there without using GitHub, and it is not included in the distribution.

Putting it in the root directory makes it obvious for non-GitHub users.

If you update your build process to include it in the distribution, then it will be available to anyone who downloads the module, and also for viewing on MetaCPAN.

[tobyink]

Despite the CPAN Security Group's recommendation, I disagree that the policy of including a security policy in the distribution root directory is a useful one.

If you install modules using the usual routes (cpanm, etc), you would never see that file. Files in the distribution root aren't installed by MakeMaker.

Having a SECURITY section in the Type::Tiny pod would seem more visible.

[robrwo]

That's a fair point in one sense, but SECURITY.md files in the distribution are highlighted on MetaCPAN.