Create SECURITY.md

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+
+## Reporting a Vulnerability
+
+Reports of any security related bugs/issues should be emailed to:
+
+[email protected]
+
+We aim to respond to security related issues within one business day.
+
+Once the bug has been triage we will provide a timeline for the fix to be applied.
+
+We expect triage to take 2-3 business days subject to the complexity of the issue.
+
+Our objective is to fix critical bugs within 24 hours of the triage completion.
+
+Timeline for other bugs will be based on the percieved risk to our customers.
+
+When reporting a bug please provide as much information as possible to help
+us reproduce the problem.
+
+It would be a rare exception for us to decline to fix a reported bug, if however we do so, you will be supplied with a reason as to why.