Create SECURITY.md

SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+## Supported Versions
+
+During the `0.x.x` phase this software is assumed to be _insecure_. Per the license terms, this software comes with no warranty, express or implied. Use the software at your own risk. During this phase we will only accept Issues and Pull Requests for the latest _major_ + _minor_ + _patch_ version:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.2.2   | :white_check_mark: |
+| 0.2.1   | :x:                |
+| 0.1.x   | :x:                |
+| < 0.1   | :x:                |
+
+Beyond the first major release, Issues and Pull Requests will only be accepted for the latest _major_ + _minor_. This means prior majors and prior minors are _unsupported_:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 2.1.x   | :white_check_mark: |
+| 2.0.x   | :x:                |
+| 1.0.x   | :x:                |
+| < 1.0   | :x:                |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability within the software, please report using the GitHub Security Advisory tool: https://github.com/keithamus/hdx/security/advisories/new.
+
+Please do not raise a standard issue in the Issue tracker, as this information is public and may expose users to unecessary risk.