Update Security Policy

SECURITY.md

@@ -1 +1,16 @@
+# Security Policy
 
+## Reporting a Vulnerability
+
+If there are any vulnerabilities in Sacremoses, don't hesitate to report them.
+
+1. Use any of the _private contact addresses_: [email protected], [email protected]. You can also use [Github's vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability).
+2. Describe the vulnerability.
+
+   If you have a fix, that is most welcome -- please attach or summarize it in your message!
+
+3. We will evaluate the vulnerability and, if necessary, release a fix or mitigating steps to address it. We will contact you to let you know the outcome, and will credit you in the report.
+
+   Please **do not disclose the vulnerability publicly** until a fix is released!
+
+4. Once we have either a) published a fix, or b) declined to address the vulnerability for whatever reason, you are free to publicly disclose it.