add .github/security.md file

.github/SECURITY.md

@@ -0,0 +1,18 @@
+# Reporting a Vulnerability
+
+<!-- https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository -->
+
+If you discover a potential security issue in this project we ask that you notify **Mask Network Security Workgroup** via email to <[email protected]>.
+
+Please do **NOT** create a public GitHub issue.
+
+When reporting an issue, where possible, please provide at least:
+
+- The project and commit version the issue was identified at
+- A proof of concept (plain-text; no binaries)
+- Steps to reproduce
+- Your recommended remediation(s), if any.
+
+## `security.txt`
+
+<https://mask.io/.well-known/security.txt>