Create SECURITY.md

SECURITY.md

@@ -0,0 +1,26 @@
+# Security Policy
+
+## Supported Versions
+
+The following versions are supported with security patches for
+any reported vulnerabilities in YARD or dependent software.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.9.x   | :white_check_mark: |
+| < 0.9   | :x:                |
+
+## Reporting a Vulnerability
+
+If you've discovered a vulnerability in YARD source code, please email
+lsegal@soen.ca with as much information as possible. You should typically
+receive a response within 24-48 hours, though depending on scheduling
+it may take up to a week to respond. If you do not get a response on
+your initial email within a few days, please re-send your email or
+reach out on other channels (such as yardoc@googlegroups.com) to
+try to get a hold of a maintainer. Please do not include sensitive
+material if you are reaching out through secondary channels unless
+you first receive confirmation that it is okay.
+
+Thank you for your help and cooperation in making YARD a stable and
+safe piece of software.