readme: add SECURITY.md (#27946)

SECURITY.md

@@ -0,0 +1,40 @@
+# Security Policy
+
+## Supported Versions
+
+V is currently in active development. Because the language is evolving
+rapidly, security updates and patches are generally only applied to the
+latest stable release and the `master` branch.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.5.x   | :white_check_mark: |
+| < 0.5.x | :x:                |
+
+## Reporting a Vulnerability
+
+We take the security of the V programming language and its standard
+library seriously.
+
+If you discover a security vulnerability, please do **not** open a public
+GitHub issue. Publicly disclosing a vulnerability can put users at risk
+before a patch is available.
+
+**How to report:**
+
+1. Please use GitHub's **Private Vulnerability Reporting** feature. Go
+   to the [Security tab](https://github.com/vlang/v/security) in this
+   repository, click on **Report a
+   vulnerability**.
+
+2. Provide a clear description of the issue, the impact, and a Proof of
+   Concept (PoC) code snippet to reproduce it.
+
+**What to expect:**
+
+* A maintainer will acknowledge receipt of your report as soon as
+  possible.
+* We will investigate the issue in a private fork.
+* If the vulnerability is confirmed, we will develop a patch, credit
+  you for the discovery, and coordinate a public disclosure alongside
+  the fix.