add security policy

docs/security.md

@@ -0,0 +1,24 @@
+Security policy
+===============
+
+Supported versions
+------------------
+
+Currently, we don't support old versions of this project - security updates will only be made
+against the main branch (= latest version).
+To stay secure, always use the latest version of this project.
+
+
+Reporting a vulnerability
+-------------------------
+
+If you think you've found a vulnerability,
+[responsible disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure) is appreciated!
+Instructions are found from our company-wide policy.
+
+
+Company-wide policy
+-------------------
+
+More details/instructions available via our company-wide policy at
+[function61.com/security](https://function61.com/security/)