Merge pull request #36 from ossf/add-security.md

Add simple SECURITY.md appropriate for a WG

Author: hythloda

SECURITY.md

@@ -0,0 +1,12 @@
+# Security
+
+Per the
+[Linux Foundation Vulnerability Disclosure Policy](https://www.linuxfoundation.org/security),
+if you find a vulnerability in a project maintained by the OpenSSF,
+please report that directly to the project maintaining that code.
+
+If you've been unable to find a way to report it,
+or have received no response after repeated attempts, please contact the
+OpenSSF security contact email, security @ openssf . org.
+
+Thank you.