Create a Security Policy (#1856)

Signed-off-by: Joyce <[email protected]>

SECURITY.md

@@ -0,0 +1,13 @@
+# Security Policy
+
+Security updates are applied only to the repository itself.
+
+## Reporting a Vulnerability
+
+Reports are limited to repo matters. Any vulnerability reports related to the addition or removal of PSL entries in the .dat file shall be rejected and referred to filing pull requests that should make mention the alleged urgency.
+
+If you have discovered a security vulnerability in this project, please report it privately. **Do not disclose it as a public issue.** This gives us time to work with you to fix the issue before public exposure, reducing the chance that the exploit will be used before a patch is released.
+
+Please disclose it at [security advisory](https://github.com/publicsuffix/list/security/advisories/new) and send an email with the link to the newly filed issue to [[email protected]](mailto:[email protected]) to expedite the review on our end.
+
+This project is maintained by a team of volunteers on a reasonable-effort basis. As such, please give us at least 90 days to work on a fix before public exposure.