chore: Create SECURITY.md

SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Supported Versions
+
+The following versions of Sanitize will receive security updates when necessary. Updates _may_ be made available for older versions on a case by case basis, but this would typically depend on community contributions since maintainer time is limited.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.x     | :white_check_mark: |
+| 4.x     | :white_check_mark: |
+| < 4.0   | :x:                |
+
+## Reporting a Vulnerability
+
+To report a security vulnerability in Sanitize, please email [[email protected]](mailto:[email protected]). Please don't PGP-encrypt your email; that's not necessary, and encrypted emails will not be read.
+
+Expect an acknowledgement of your report within 48 hours. If the vulnerability is confirmed, every effort will be made to release a fix as soon as is practical depending on the severity and complexity of the issue. Once a solution is available, the vulnerability will be publicly disclosed and (if desired) you will be credited for finding and reporting it.