Add security policy

SECURITY.md

@@ -0,0 +1,36 @@
+# Security Policy
+
+## Supported Versions
+
+The latest release in the v3 series is the actively supported version.
+
+| Version | Security support |
+| --- | --- |
+| Latest v3 release | Supported |
+| Earlier v3 releases | Please upgrade; fixes are evaluated case by case |
+| v2 | Evaluated case by case, depending on severity and feasibility |
+| v1 | Not supported |
+
+We recommend upgrading to the latest v3 release before reporting an issue that
+may already have been fixed.
+
+## Reporting a Vulnerability
+
+Please report suspected vulnerabilities through GitHub's
+[private vulnerability reporting](https://github.com/shamaton/msgpack/security/advisories/new).
+
+Do not open a public issue or discussion for an undisclosed vulnerability. In
+your private report, include the following when possible:
+
+- The affected package and version
+- A description of the impact and attack scenario
+- Minimal steps or code needed to reproduce the issue
+- Any suggested mitigation or fix
+
+Please do not include credentials, production data, or other secrets in the
+report.
+
+The maintainers will review reports as availability allows. Response and fix
+timelines cannot be guaranteed and depend on the severity and complexity of the
+issue. Please allow time for investigation and coordinated disclosure before
+publishing details.