docs: add security.md

Signed-off-by: Asra Ali <[email protected]>

docs/SECURITY.md

@@ -0,0 +1,19 @@
+# Security Policy
+
+The go-tuf community is committed to maintaining a reliable and consistent TUF client implementation. If you believe you have identified a security issue in go-tuf's client protocol, please follow these guidelines for responsible disclosure.
+
+## Supported Versions
+
+You may report issues for the most recent version of go-tuf. We will not retroactively make changes to older versions.
+
+## Reporting a Vulnerability
+
+If you discover a potential security issue in this project we ask that you notify the go-tuf maintainers via our [vulnerability reporting form](https://forms.gle/ShM4s3mLbUAx5QHo8). At the minimum, the report must contain the following:
+* A description of the issue.
+* Instructions to reproduce the issue.
+
+Please do **not** create a public GitHub issue to submit vulnerability reports. The GitHub issue tracker is intended for bug reports and feature requests. Major feature requests, such as design changes to the specification, should be proposed via a [TUF Augmentation Protocol](https://theupdateframework.github.io/specification/latest/#tuf-augmentation-proposal-tap-support) (TAP).
+
+## Disclosure
+
+This project follows a 90 day disclosure timeline.