Create SECURITY.md

Author: chaoming0625

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Reporting a bug in BrainPy
+
+Report security bugs in BrainPy via [Github Issue](https://github.com/brainpy/BrainPy/issues).
+
+Normally your report will be acknowledged within 5 days, and you'll receive a more detailed response 
+to your report within 10 days indicating the next steps in handling your submission. These timelines 
+may extend when our triage volunteers are away on holiday, particularly at the end of the year.
+
+After the initial reply to your report, the security team will endeavor to keep you informed of the 
+progress being made towards a fix and full announcement, and may ask for additional information or 
+guidance surrounding the reported issue.
+
+## Reporting a bug in a third party module
+
+Security bugs in third party modules should be reported to their respective maintainers.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this project, please report it to us as soon as possible. 
+We appreciate your efforts and responsible disclosure and will make every effort to acknowledge your 
+contributions.