Merge pull request #378 from OpenChemistry/add-security-policy

Create SECURITY.md

SECURITY.md

@@ -0,0 +1,20 @@
+# Security Policy 
+
+## Supported Versions 
+
+At the moment, Avogadro2 is in beta release. As such, we can most easily support 
+security updates on the most recent release and current nightly snapshots. 
+We will work with distributions (e.g., Ubuntu, FreeBSD, etc.) to provide security 
+patches for widely used long-term-support OS.
+
+| Version | Supported          | 
+| ------- | ------------------ | 
+| 1.97.x  | :white_check_mark: |
+| < 1.97  | :x:                |
+
+## Reporting a Vulnerability 
+
+We currently support private security vulnerability reporting through our 
+[GitHub](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability) 
+pages. We will work to verify the security vulnerability within 14 days 
+and a patch or new release within 30 days of reporting.