docs: bug bounty

Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>

docs/developer-guide/bug_bounty.md

@@ -0,0 +1,15 @@
+Money given to the Argo CD project as part of the Internet Bug Bounty program is used in three ways:
+
+1. To reward CVE patch contributors
+2. To offer bounties on security enhancements (as announced by label/comment on Issues)
+3. To sponsor security-relevant dependencies
+
+If someone’s primary full-time job responsibility is to work on Argo CD, then their eligibility to receive this money is limited. (Determining this is up to the maintainers’ discretion. Someone who contributes an average of three commits per week during work hours probably meets the definition. A first-time contributor who uses Argo CD daily as an SRE does not.)
+
+A full-time Argo CD author is not eligible to receive rewards for CVE patch contributions. This avoids any risk of the appearance that a full-time Argo CD author is incentivized to introduce CVEs.
+
+A full-time Argo CD author is eligible to receive bounties for security enhancements if and only if the vast majority of the work is done in their free time (non-work hours). Busy work like resolving merge conflicts during work hours is acceptable (to avoid over-burdening the process).
+
+An Argo CD dependency is eligible to receive donations if it is listed in the Argo CD SBOM or if it is a binary invoked by Argo CD (like Helm). The dependency is not eligible for donations if a full-time Argo CD author is the primary author of the dependency.
+
+Offers and transfers of rewards, bounties, and donations will be made from time to time by the Argo CD maintainers, based on the current project needs and the amount of money available from IBB. The process should be lightweight and consensus-based for now. If necessary, a more structured system can be established based on experience gained from early rewards/bounties/donations