new vulnerability policy

Author: simsong

SECURITY.md

@@ -0,0 +1,16 @@
+# Security Policy
+
+## Supported Versions
+
+This is not supported software. However, we try to accept pull requests on a regular basis. 
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities publicly using GitHub's Security reporting feature. 
+
+We prefer vulnerability reports to be accompanied by:
+- Proof of concept (PoC) that demonstrates the vulnerability
+- A unit test that fails because of the vulnerability
+- A PR that fixes the vulnerability and makes the system pass the unit test.
+
+Thanks!