Create SECURITY.md

SECURITY.md

@@ -0,0 +1,14 @@
+# Security Policy
+
+## To report a security issue
+
+1. Use the contact address scadalts-support (at) softq.pl
+2. Provide description of the issue, the steps you took to create the issue, affected versions, and, if known, mitigations for the issue etc.
+
+- If you have a fix, that is most welcome -- please attach or summarize it in your message!
+
+3. We will evaluate the vulnerability and, if necessary, release a fix or mitigating steps to address it. We will contact you to let you know the outcome, and will credit you in the report.
+
+- Please **do not disclose the vulnerability publicly** until a fix is released!
+
+4. Once we have either a) published a fix, or b) declined to address the vulnerability for whatever reason, you are free to publicly disclose it.