docs: add SECURITY.md (#487)

SECURITY.md

@@ -0,0 +1,9 @@
+# Security
+
+## Reporting a vulnerability in Rsdoctor
+
+Report a security vulnerability in Rsdoctor via [email protected].
+
+Normally, your report will be acknowledged within 24 hours, and you'll receive a more detailed response to your report within 5 days indicating the next steps in handling your submission.
+
+After the initial reply to your report, the security team will endeavor to keep you informed of the progress being made towards a fix and full announcement, and may ask for additional information or guidance surrounding the reported issue.