add SECURITY.md

Signed-off-by: Ceki Gulcu <[email protected]>

SECURITY.md

@@ -0,0 +1,23 @@
+
+## Reporting security issues
+
+Please report security issues related to the SLF4J project to the
+following email address:
+
+   support(at)qos.ch
+
+
+## Verifying contents
+
+All SLF4J project artifacts published on Maven central are signed. For
+each artifact, there is an associated signature file with the .asc
+suffix.
+
+To verify the signature use [this public key](https://www.slf4j.org/public-keys/ceki-public-key.pgp). Here is its fingerprint:
+
+```
+pub   2048R/A511E325 2012-04-26
+Key fingerprint = 475F 3B8E 59E6 E63A A780  6748 2C7B 12F2 A511 E325
+uid   Ceki Gulcu <[email protected]>
+sub   2048R/7FBFA159 2012-04-26
+```