Add a security policy

SECURITY.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+## Supported Versions
+
+The following releases of Saleor are currently supported.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 2.9.x   | :white_check_mark: |
+| < 2.9   | :x:                |
+
+## Reporting a Vulnerability
+
+Please DO NOT report security vulnerabilities using a public GitHub issue. If you believe you've found a security issue, please contact our security mailing list:
+
+security@getsaleor.com
+
+You will be credited as the reporter once a fix is ready to be published. At this time we do not have a bounty program in place so we are not able to offer monetary rewards for any problems reported.