doc(both): update project docs (#3897)

CODE_OF_CONDUCT.md

@@ -0,0 +1,3 @@
+# Contributor Covenant Code of Conduct
+
+See the [Contributor Covenant Code of Conduct](https://github.com/pingcap/community/blob/master/CODE_OF_CONDUCT.md)

CONTRIBUTING.md

@@ -14,7 +14,7 @@ your contribution accepted.
 
 Developing TiDB-CDC requires:
 
-* [Go 1.13+](http://golang.org/doc/code.html)
+* [Go 1.16+](https://go.dev/doc/code)
 * An internet connection to download the dependencies
 
 Simply run `make` to build the program.
@@ -32,7 +32,7 @@ For more information on how to trigger these tests, please see the [command help
 
 ### Updating dependencies
 
-TiDB-CDC uses [Go 1.11 module](https://github.com/golang/go/wiki/Modules) to manage dependencies. To add or update a
+TiDB-CDC uses [Go Modules](https://github.com/golang/go/wiki/Modules) to manage dependencies. To add or update a
 dependency: use the `go mod edit` command to change the dependency.
 
 ## Contribution flow

SECURITY.md

@@ -0,0 +1,33 @@
+# Security Vulnerability Disclosure and Response Process
+
+TiDB is a fast-growing open source database. To ensure its security, a security vulnerability disclosure and response process is adopted.
+
+The primary goal of this process is to reduce the total exposure time of users to publicly known vulnerabilities. To quickly fix vulnerabilities of TiDB products, the security team is responsible for the entire vulnerability management process, including internal communication and external disclosure.
+
+If you find a vulnerability or encounter a security incident involving vulnerabilities of TiDB products, please report it as soon as possible to the TiDB security team (security@tidb.io).
+
+Please kindly help provide as much vulnerability information as possible in the following format:
+
+- Issue title*:
+
+- Overview*:
+
+- Affected components and version number*:
+
+- CVE number (if any):
+
+- Vulnerability verification process*:
+
+- Contact information*:
+
+The asterisk (*) indicates the required field.
+
+# Response Time
+
+The TiDB security team will confirm the vulnerabilities and contact you within 2 working days after your submission.
+
+We will publicly thank you after fixing the security vulnerability. To avoid negative impact, please keep the vulnerability confidential until we fix it. We would appreciate it if you could obey the following code of conduct:
+
+The vulnerability will not be disclosed until TiDB releases a patch for it.
+
+The details of the vulnerability, for example, exploits code, will not be disclosed.