docs(*): add security policy

Signed-off-by: Ted "skjsjhb" Gao <[email protected]>

SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Supported Versions
+
+Alicorn provides no security updates for versions except the latest stable release.
+
+As Alicorn is backward-compatible at the same major version, users at the latest major version should update to receive security updates.
+
+Users running previous major versions should consider upgrading to the latest version.
+
+## Reporting a Vulnerability
+
+To report a vulnerability that's safe to be published, open an issue.
+
+To report a vulnerability secretly, contact [[email protected]](mailto:[email protected]).
+
+We check the inbox frequently, yet provide no guarantee for the response time.