Create SECURITY.md

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+We will disclose fixes for vulnerabilities in the release notes and urge you to upgrade once a new release is published. 
+For upgrading guidelines, see [our official Upgrading Guideline](https://devpod.sh/docs/getting-started/update).
+
+**To receive update warnings in the CLI (as part of the terminal output whenever you run a command), you must use an official release binary as published on the [GitHub releases page](https://github.com/loft-sh/devpod/releases) of this project.**
+
+See the [install instructions for DevPod](https://devpod.sh/docs/getting-started/install) for the recommended methods of downloading an official release binary for your platform. Community maintained release binaries may **not** contain the version number and will therefore not be able to perform a version check.
+
+
+## Reporting a Vulnerability
+Please report vulnerabilities to: [[email protected]](mailto:[email protected])