add SECURITY.md

Author: C.A.P. Linssen

SECURITY.md

@@ -0,0 +1,33 @@
+# Security Policy
+
+NEST Simulator is research-oriented software and as such is expected to
+run mainly in well-protected environments. In case it is found that this
+software can be used to violate security mechanisms, developers will try to
+provide patches that mitigate the risk of this misuse.
+
+The current policy is explained in SECURITY.md in the NEST Simulator
+main branch. The policy can also be found at
+<https://github.com/nest/nest-simulator/security/policy>.
+
+## Supported Versions
+
+Generally only the latest release will receive security related
+updates. Currently the following versions are being supported with security
+updates:
+
+| Version  | Supported              |
+| -------- | ---------------------- |
+| main     | yes :heavy_check_mark: |
+
+## Reporting a Vulnerability
+
+For reporting a vulnerability please create a security advisory on the
+nest/nestml [Security
+Advisories](https://github.com/nest/nest-simulator/security/advisories)
+page. You need a GitHub account to create an advisory.
+
+Developers will then contact the reporter in a timely manner to assess
+severity and further handling via [Security
+Advisories](https://github.com/nest/nestml/security/advisories)
+or as normal [Issue](https://github.com/nest/nest-simulator/issues) in
+non-critical cases.