Create SECURITY.md

SECURITY.md

@@ -0,0 +1,25 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If there are any vulnerabilities in **RootAsRole**, don't hesitate to _report them_.
+
+1. Use any of the [private contact addresses](https://github.com/LeChatP/RootAsRole#contributors).
+2. Describe the vulnerability.
+
+   If you have a fix, that is most welcome -- please attach or summarize it in your message!
+
+3. We will evaluate the vulnerability and, if necessary, release a fix or mitigating steps to address it. We will contact you to let you know the outcome, and will credit you in the report.
+
+   Please **do not disclose the vulnerability publicly** until a fix is released!
+
+4. Once we have either a) published a fix, or b) declined to address the vulnerability for whatever reason, you are free to publicly disclose it.
+
+## Supported Versions
+
+We consider versions under v3.0 are unsafe to use in production.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 3.0.x   | :white_check_mark: |
+| < 3.0   | :x:                |