Add security policy (#343)

SECURITY.md

@@ -0,0 +1,25 @@
+# Security policy
+
+GitHub's bots crawl `turbo-cache` to detect security vulnerabilities wherever
+possible.
+
+TraceMachina and the `turbo-cache` authors place a high emphasis on fixing any
+vulnerabilities. Please send a report if something doesn't look right.
+
+## Supported versions
+
+At the moment no version of `turbo-cache` is officially supported. Consider
+using the latest commit on the `main` branch until official production binaries
+are released.
+
+## Reporting a vulnerability
+
+Prefer reporting vulnerabilities via [GitHub](https://github.com/TraceMachina/turbo-cache/security).
+
+If you'd rather communicate via email please contact <blaise@tracemachina.com>,
+<marcus@tracemachina.com>, <blake@tracemachina.com> or <aaron@tracemachina.com>.
+
+## Vulnerability disclosure and advisories
+
+See [Advisories](https://github.com/TraceMachina/turbo-cache/security/advisories)
+for publicly disclosed vulnerabilities.