Merge pull request #4 from terrajobst/add-security-md

Add SECURITY.md

SECURITY.md

@@ -2,14 +2,14 @@
 
 ## Supported Versions
 
-| Version | Supported          |
-| ------- | ------------------ |
-| <= 1.7  | :x:                |
-| 1.8.x   | :white_check_mark: |
-| 2.0.x   | :white_check_mark: |
+The .NET Core and ASP.NET Core support policy, including supported versions can be found at the [.NET Core Support Policy Page](https://dotnet.microsoft.com/platform/support/policy/dotnet-core).
 
 ## Reporting a Vulnerability
 
-Please use email to contact the project's main contributors with any vulnerability you become aware of.
+Security issues and bugs should be reported privately to the Microsoft Security Response Center (MSRC), either by emailing [email protected] or via the portal at https://msrc.microsoft.com.
+You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your
+original message. Further information, including the MSRC PGP key, can be found in the [MSRC Report an Issue FAQ](https://www.microsoft.com/en-us/msrc/faqs-report-an-issue).
 
-    Yoshifumi Kawai <[email protected]>; Andrew Arnott <[email protected]>
+Reports via MSRC may qualify for the .NET Core Bug Bounty. Details of the .NET Core Bug Bounty including terms and conditions are at [https://aka.ms/corebounty](https://aka.ms/corebounty).
+
+Please do not open issues for anything you think might have a security implication.