Create SECURITY.md

SECURITY.md

@@ -0,0 +1,13 @@
+### Reporting a vulnerability
+
+For all Gaia security-related defects, please send an email to [email protected]. You will receive an acknowledgment mail within 24 hours. After that, we will be sure to give a detailed response about the next step in 48 hours. Please do not submit security vulnerabilities directly as GitHub Issues.
+
+### Disclosure policy
+
+We will disclose known public security vulnerabilities as soon as possible after receiving the report. Vulnerabilities discovered for the first time will be disclosed by the following process:
+
+* The received security vulnerability report shall be handed over to the security team for follow-up coordination and repair work.
+* After the vulnerability is confirmed, we will create a draft Security Advisory on Github that lists the details of the vulnerability.
+* Invite related personnel to discuss about the fix.
+* Fork the temporary private repository on Github, and collaborate to fix the vulnerability.
+* After the fix code is merged into all supported versions, the vulnerability will be publicly posted in the GitHub Advisory Database.