Merge branch 'develop' of https://github.com/authzforce/core.git into develop

CONTRIBUTING.md

 ## Contributing
-### Contribution Rules
+### Coding Rules
+Follow these Java coding guidelines:
+* [Google Java Style Guide](https://google.github.io/styleguide/javaguide.html), except braces must follow the Allman style instead of K & R style;
+* *Effective Java, Second Edition*, by Joshua Bloch;
+* [Oracle Secure Coding Guidelines for Java SE](http://www.oracle.com/technetwork/java/seccodeguide-139067.html).
+
+### Testing
+For every new major functionality, there must be unit tests added to some unit test class that is part of the automated test suite of [pdp-engine's MainTest.java](pdp-engine/src/test/java/org/ow2/authzforce/core/pdp/impl/test/MainTest.java). If the functionality has any impact on XACML - any Request/Response/Policy(Set) element - processing and/or change XACML standard conformance in anyway, make sure you add relevant integration and/or conformance tests to the test suite run by [pdp-testutils's MainTest.java](pdp-testutils/src/test/java/org/ow2/authzforce/core/pdp/testutil/test/MainTest.java).
+
+### Dependency management
 1. No SNAPSHOT dependencies on "develop" and obviously "master" branches
 
 ### Releasing

README.md

@@ -145,5 +145,8 @@ Please include as much information as possible; the more we know, the better the
 
 If you wish to contact the developers for other reasons, use [AuthzForce contact mailing list](http://scr.im/azteam).
 
+## Vulnerability reporting
+If you want to report a vulnerability, you must do so on the [OW2 Issue Tracker](https://jira.ow2.org/browse/AUTHZFORCE/) with *Security Level* set to **Private**. Then, if the AuthzForce team can confirm it, they will change it to **Public** and set a fix version.
+
 ## Contributing
 See [CONTRIBUTING.md](CONTRIBUTING.md).