Create SECURITY.md

Having this file means GitHub UI highlights this as the policy when people create issues.

More:
https://help.github.com/en/github/managing-security-vulnerabilities/adding-a-security-policy-to-your-repository

Author: David Read

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Supported Versions
+
+Security updates are offered for the **3 most recent** minor CKAN releases. They are included in patch releases, but not acknowledged in the release announcement or [CHANGELOG.rst](CHANGELOG.rst), hence the advice to always run the latest patch releases.
+
+For more about CKAN releases see: https://docs.ckan.org/en/2.8/maintaining/upgrading/#ckan-releases
+
+## Reporting a Vulnerability
+
+If you find a potential security vulnerability please email security@ckan.org, rather than creating a public issue on GitHub.