add security policy (#1508)

* add security policy

* fix wording

* rephrase version scope for vulnerability reports

SECURITY.md

@@ -0,0 +1,9 @@
+# Security Policy
+
+We currently accept reports for vulnerabilities on all published versions of the project. 
+
+## Reporting a Vulnerability
+
+You can disclose vulnerabilities securely through the [Netflix Bugcrowd](https://bugcrowd.com/netflix) site. When reporting a finding, mention the project name or repository in the title and the report will find its way to the correct people.
+
+Please note that at the moment, the Metaflow project does not offer a bounty for any disclosure.