Create SECURITY.md (#14112)

Create SECURITY.md

Point README.md to SECURITY.md to avoid duplicated information, and
removed the explicit version table in SECURITY.md to make it easier to
keep up to date.

README.md

@@ -79,7 +79,7 @@ Some questions come up over and over again. Check here first:
 
 # Security Disclosure
 
-Security is very important to us. If you discover any issue regarding security, please disclose the information responsibly by sending an email to security@metabase.com and not by creating a GitHub issue.
+See [SECURITY.md](./SECURITY.md) for details.
 
 # Contributing
 

SECURITY.md

+# Security Policy
+
+Security is very important to us at Metabase.
+
+## Supported Versions
+
+We typically only support the latest release of Metabase for maintenance updates, but depending on the nature of the security issue we may issue hotfixes for arbitrarily earlier versions of Metabase.
+
+## Reporting a Vulnerability
+
+If you discover any issue regarding security, please disclose the information responsibly by sending an email to security@metabase.com and not by creating a GitHub issue. We'll get back to you ASAP and work with you to confirm and plan a fix for the issue.
+
+Please note that we do not currently offer a bug bounty program.