Create SECURITY.md.

.github/SECURITY.md

@@ -0,0 +1,16 @@
+# Reporting a Vulnerability
+
+If you discover a security vulnerability in this project or the version in
+the Linux kernel, please report it privately.
+**Do not disclose it as a public issue.** This gives
+us time to work with you to fix the issue before public exposure, reducing
+the chance that the exploit will be used before a patch is released.
+
+You may submit a report by emailing us at
+[xz@tukaani.org](mailto:xz@tukaani.org), or through
+[Security Advisories](https://github.com/tukaani-project/xz-embedded/security/advisories/new).
+While both options are available, we prefer email.
+
+This project is maintained by a team of volunteers on a reasonable-effort
+basis. As such, please give us 90 days to work on a fix before
+public exposure.