security: add a security policy

SECURITY.md

@@ -0,0 +1,18 @@
+# Xash3D FWGS Security Policy
+
+## Supported versions
+
+Because we don't have clear release cycle yet, support is only provided to the
+latest engine versions from `master` branch. You can use `host_ver` command in
+console to fetch detailed info about the engine build.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this project, it can be reported
+privately though `Security` tab on GitHub:
+https://github.com/FWGS/xash3d-fwgs/security
+
+Alternatively, you can report them publicly on the `Issues` tab:
+https://github.com/FWGS/xash3d-fwgs/issues
+
+In both cases, expect a reply within approximately a week.