Create SECURITY.md

[dcmcand]

What does this implement/fix?

Add's Security.md with instructions on reporting vulnerabilities.

Put a x in the boxes that apply

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds a feature)
• Breaking change (fix or feature that would cause existing features not to work as expected)
• Documentation Update
• Code style update (formatting, renaming)
• Refactoring (no functional changes, no API changes)
• Build related changes
• Other (please describe): Repository maintenance

Testing

• Did you test the pull request locally?
• Did you add new tests?

Any other comments?

[marcelovilla]

This looks good to me. I only have two small suggestions but you can feel free to incorporate or ignore them:

1. I'd link to https://github.com/nebari-dev/nebari/security/advisories/new instead of https://github.com/nebari-dev/nebari/security
2. I'd explicitly tell people to NOT report a vulnerability on a public issue.

[krassowski]

In rare instances if someone does not have/want to use a GitHub account, is there a monitored email address they could send the vulnerability disclosure to? It is not strictly necessary but nice to have, conditional on someone actually monitoring such a mailbox.

[dcmcand]

In rare instances if someone does not have/want to use a GitHub account, is there a monitored email address they could send the vulnerability disclosure to? It is not strictly necessary but nice to have, conditional on someone actually monitoring such a mailbox.

There is not one that I am aware of.

[dcmcand]

Thanks @marcelovilla and @krassowski, I added both of your changes