Add a SECURITY.md file

(fixes #898)

SECURITY.md

@@ -0,0 +1,49 @@
+# Security Policy
+
+## Supported Versions
+
+Security updates and patches are typically applied
+to the latest active release series of EPICS Base.
+Older, end-of-life release series
+do not receive security backports
+unless specifically maintained by community contributions.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 7.0.x   | :white_check_mark: |
+| 3.15.x  | :white_check_mark: |
+| < 3.15  | :x:                |
+
+---
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities
+through public GitHub issues, discussions, pull requests,
+or by using EPICS mailing lists.**
+
+If you discover a security vulnerability within EPICS Base,
+please report it privately first,
+so that it can be addressed responsibly before public disclosure:
+
+- **Primary Method:**
+  Please file a **Private Security** report or issue
+  via the project's tracking systems
+  or reach out directly to the EPICS Core developers via the
+  [EPICS Security email address](mailto:security@epics-controls.org)
+  or core development contacts.
+- **Details to Include:**
+  - A description of the vulnerability and its potential impact.
+  - Step-by-step instructions
+    or proof-of-concept code to reproduce the issue.
+  - The specific version(s) of EPICS Base affected.
+- **AI-Generated Reports:**
+  - Please double-check findings for hallucinations
+    before reporting them.
+  - With the wide availability of AI-based tools,
+    we will treat many of those reports as public bugs.
+    However, we still prefer the first report to be private.
+
+You can expect an acknowledgment of your report,
+followed by coordination
+on a timeline for investigation and public patching.