Add SECURITY.md

CONTRIBUTING.md

@@ -91,6 +91,8 @@ To make a code contribution to Duktape
 To report bugs or request features
 ----------------------------------
 
+See [SECURITY.md](https://github.com/svaarala/duktape/blob/master/SECURITY.md) for reporting security vulnerabilities.
+
 Use GitHub issues to report bugs or request features:
 
 * Please include a compilation or execution log to help diagnosis.

README.md

@@ -207,10 +207,7 @@ not backwards compatible.  See
 Reporting bugs
 --------------
 
-See [CONTRIBUTING.md](https://github.com/svaarala/duktape/blob/master/CONTRIBUTING.md).
-
-Security critical GitHub issues (for example anything leading to a segfault)
-are tagged `security`.
+See [CONTRIBUTING.md](https://github.com/svaarala/duktape/blob/master/CONTRIBUTING.md) and [SECURITY.md](https://github.com/svaarala/duktape/blob/master/SECURITY.md).
 
 Contributing
 ------------

SECURITY.md

@@ -0,0 +1,14 @@
+# Security policy
+
+## Supported versions
+
+Fixes for security vulnerabilities are made to master and latest
+major release, and on a case-by-case for other maintained versions.
+
+## Reporting a vulnerability
+
+Please report (suspected) security vulnerabilities to
+**[sami.vaarala@ik.fi](mailto:sami.vaarala@iki.fi)**.
+
+Security critical GitHub issues (for example anything leading to a segfault)
+can be tagged `security`.