SECURITY.md

Sensitive security issues can be reported to [email protected]. Please use the regular issue tracker if the issue does not need to be kept private.