VULN-DISCLOSURE-POLICY: use of weak algos

Not necessarily security problems.

Closes #17220

docs/VULN-DISCLOSURE-POLICY.md

@@ -337,3 +337,13 @@ A *legacy dependency* is here defined as:
 
 - there are modern versions of equivalent or better functionality offered and
   in common use
+
+## weak algorithms required for functionality
+
+curl supports several algorithms that are considered weak, like DES and MD5.
+These algorithms are still not curl security vulnerabilities or security
+problems as they are only used when the users explicitly ask for their use by
+using the protocols or options that require the use of those algorithms.
+
+When servers upgrade to use secure alternatives, curl users should use those
+options/protocols.