create SECURITY.md (#1997)

SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Email Contact
+
+security@gpac.io
+
+## Supported Versions
+
+GPAC is under constant development using a continuous integration and deployment process. As a consequence the `HEAD` of the `master` branch is always considered as the _current version_ at any point. 
+
+Thus only reports that are confirmed reproducible on the current `HEAD` of the `master` branch will receive a patch. 
+
+
+## Reporting a Vulnerability
+
+Vulnerabilities (as well as other bugs) should be reported directly using the [Github issue trakcer](https://github.com/gpac/gpac/issues). 
+
+Please include all information needed to reproduce the issue, including a sample file. 
+
+Sample files can be joined directly via github (preferred way) or uploaded to the [GPAC file drop](https://www.mediafire.com/filedrop/filedrop_hosted.php?drop=eec9e058a9486fe4e99c33021481d9e1826ca9dbc242a6cfaab0fe95da5e5d95).
+
+However if public disclosure seems unreasonable, or if confidential information needs to be shared, you can contact securiy@gpac.io for private disclosure.