chore(sec): add security.md

SECURITY.md

@@ -0,0 +1,12 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it by email to
+**bugs@sogo.nu**.
+
+Please do **not** open a public issue for security issues.
+
+Include as much detail as possible: a description of the issue, steps to
+reproduce, affected versions, and any potential impact. We will respond as
+soon as possible and credit reporters when appropriate once a fix is released.