Add security policy

Copied from aspnet-contrib/AspNet.Security.OAuth.Providers#717.

Author: martincostello

.github/SECURITY.md

@@ -0,0 +1,15 @@
+# Security policy
+
+## Supported Versions
+
+Only versions of the providers that target versions of ASP.NET Core that are in support by Microsoft are supported by the maintainers.
+
+The .NET Core and ASP.NET Core support policy, including currently supported versions, can be found at the [.NET and .NET Core Support Policy page](https://dotnet.microsoft.com/platform/support/policy/dotnet-core).
+
+## Reporting a Vulnerability
+
+Security issues and bugs should be reported privately by emailing [[email protected]](mailto:[email protected]).
+
+You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message.
+
+Please do not open GitHub issues for anything you think might have a security implication.

README.md

@@ -39,6 +39,10 @@ See the [/samples](https://github.com/aspnet-contrib/AspNet.Security.OpenId.Prov
 
 We would love it if you could help contributing to this repository.
 
+## Security policy
+
+Please see [SECURITY.md](./.github/SECURITY.md) for information about reporting security issues and bugs.
+
 ## Support
 
 **Need help or wanna share your thoughts?** Don't hesitate to join us on Gitter or ask your question on StackOverflow: