Merge pull request #691 from appneta/Bug_#689_security_policy

Bug #689: add security policy document

docs/CHANGELOG

@@ -1,4 +1,5 @@
 06/19/2021 Version 4.4.0-beta1
+    - add a security policy document (#689)
     - option --skipbroadcast not working (#677)
     - add feature VLAN Q-in-Q (#625)
 

docs/SECURITY.md

@@ -0,0 +1,29 @@
+
+<!-- @import "[TOC]" {cmd="toc" depthFrom=1 depthTo=6 orderedList=false} -->
+
+<!-- code_chunk_output -->
+
+- [Security Policy](#security-policy)
+  - [Supported Versions](#supported-versions)
+  - [Reporting a Vulnerability](#reporting-a-vulnerability)
+
+<!-- /code_chunk_output -->
+
+# Security Policy
+
+## Supported Versions
+
+We release patches for security vulnerabilities. Which versions are eligible
+receiving such patches depend on the CVSS v3.0 Rating:
+
+| CVSS v3.0 | Supported Versions                        |
+| --------- | ----------------------------------------- |
+| 9.0-10.0  | Releases within the previous year         |
+| 4.0-8.9   | Most recent release                       |
+
+## Reporting a Vulnerability
+
+Please report (suspected) security vulnerabilities to
+**[tcpreplay@appneta.com](mailto:appneta.com)**. You will receive a response from
+us within 72 hours. If the issue is confirmed, we will release a patch as soon
+as possible depending on complexity but historically within a few days.