Update SECURITY-INSIGHTS.yml with additional information

Signed-off-by: John Kjell <[email protected]>

SECURITY-INSIGHTS.yml

@@ -15,10 +15,67 @@
 header:
   schema-version: 1.0.0
   expiration-date: '2024-08-31T10:10:09.000Z'
-  last-updated: '2023-12-06'
-  last-reviewed: '2023-12-06'
+  last-updated: '2023-12-17'
+  last-reviewed: '2023-12-17'
   commit-hash: cd0c222058a8830a8e190b840e466098b25a3c41
   project-url: https://github.com/in-toto/go-witness
-  project-release: 'v0.17.0'
-  changelog: https://github.com/in-toto/go-witness/releases/tag/v0.17.0
+  project-release: 'v0.2.0'
+  changelog: https://github.com/in-toto/go-witness/releases/tag/v0.2.0
   license: https://github.com/in-toto/go-witness/blob/main/LICENSE
+
+project-lifecycle:
+  status: active
+  roadmap: https://github.com/orgs/in-toto/projects/4/views/3
+  bug-fixes-only: false
+  core-maintainers:
+  - https://github.com/in-toto/go-witness/MAINTAINERS.md
+  release-cycle: https://github.com/in-toto/go-witness/releases
+
+contribution-policy:
+  accepts-pull-requests: true
+  accepts-automated-pull-requests: true
+  contributing-policy: https://github.com/in-toto/go-witness/blob/main/CONTRIBUTING.md
+  code-of-conduct: https://github.com/in-toto/go-witness/blob/main/CODE_OF_CONDUCT.md
+
+documentation:
+  - https://witness.dev
+
+distribution-points:
+  - https://github.com/in-toto/go-witness/releases
+
+security-testing:
+- tool-type: sca
+  tool-name: Dependabot
+  tool-version: 2
+  tool-url: https://github.com/dependabot
+  integration:
+    ad-hoc: false
+    ci: true
+    before-release: false
+
+security-contacts:
+- type: email
+  value: [email protected]
+  primary: true
+
+vulnerability-reporting:
+  accepts-vulnerability-reports: true
+  email-contact: [email protected]
+  security-policy: https://github.com/in-toto/go-witness/SECURITY.md
+
+dependencies:
+  third-party-packages: true
+  dependencies-lists:
+  - https://github.com/in-toto/go-witness/go.mod
+  sbom:
+  - sbom-file: https://foo.bar/sbom
+    sbom-format: CycloneDX
+    sbom-url: https://foo.bar
+  dependencies-lifecycle:
+    policy-url: https://github.com/in-toto/go-witness/SECURITY.md
+    comment: |
+      All dependencies are subject to the Witness Security Policy.
+  env-dependencies-policy:
+    policy-url: https://github.com/in-toto/go-witness/SECURITY.md
+    comment: |
+      All dependencies are subject to the Witness Security Policy.