add SECURITY.md (envoyproxy#5167)

Signed-off-by: Arko Dasgupta <[email protected]>
(cherry picked from commit f7a10eb)
Signed-off-by: Guy Daich <[email protected]>

SECURITY.md

@@ -0,0 +1,39 @@
+# Security Policy
+
+## Reporting a Vulnerability or a Crash
+
+We take security seriously and appreciate your help in identifying and responsibly disclosing vulnerabilities to protect our users.
+
+To report a security issue:
+
+1. **Do not open a public issue** on the GitHub repository to disclose a vulnerability.
+2. Send an email to our security team at [[email protected]](mailto:[email protected]).
+3. Include the following details in your email:
+    - A detailed description of the vulnerability.
+    - Steps to reproduce the issue.
+    - Potential impact of the vulnerability.
+    - Any suggested remediation or patches (if applicable).
+
+We aim to respond to vulnerability reports within **48 hours** and will work with you to validate and address the issue. 
+Once a resolution is identified, we will coordinate a release timeline with you and provide credit if applicable (with your consent).
+
+## Security Updates
+
+Security patches are announced through:
+
+- The [GitHub Releases page](https://github.com/envoyproxy/gateway/releases)
+
+To stay up-to-date with the latest security updates, we recommend subscribing to these channels.
+
+## Best Practices for Secure Usage
+
+To minimize security risks when using Envoy Gateway:
+
+- Use the latest supported version of Envoy Gateway.
+- Regularly monitor for updates and apply patches promptly.
+
+## Contact
+
+If you have any questions about this security policy, please contact us at [[email protected]](mailto:[email protected]).
+
+Thank you for helping us ensure the security of Envoy Gateway!