Create SECURITY.md

SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Supported Versions
+
+* We use [Semantic Versioning](https://semver.org/).
+* Each version is supported until the next one is released (e.g. 1.1.x will be supported until 1.2.0 is out).
+* Release Candidates are available before the release (e.g. 1.1.0-rc1, 1.1.0-rc2, 1.1.0-rc3, 1.1.0-rc4, before 1.1.0).
+* Bug-fixes (e.g. 1.1.1, 1.1.2, 1.2.1, 1.2.3) are released as needed (no additional features are delivered in those versions, bug-fixes only).
+
+| Version   | Supported          |
+|-----------|--------------------|
+| `0.1.x`   | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+We want to keep Bifröst safe for everyone.
+If you've discovered a security vulnerability in Bifröst, we appreciate your help in disclosing it to us in a responsible manner, by creating a [security advisory](https://github.com/engity-com/bifroest/security/advisories).