Add security.md (#4126)

SECURITY.md

@@ -0,0 +1,36 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are provided for the current released version of LNbits and the
+`dev` branch. Older releases and release candidates are not supported unless a
+maintainer explicitly states otherwise.
+
+| Version            | Supported |
+| ------------------ | --------- |
+| Current release    | Yes       |
+| `dev` branch       | Yes       |
+| Older releases     | No        |
+| Release candidates | No        |
+
+## Reporting a Vulnerability
+
+Please report suspected vulnerabilities privately using [GitHub's private
+vulnerability reporting](https://github.com/lnbits/lnbits/security/advisories/new).
+Do not open a public issue, discussion, or pull request for a security
+vulnerability.
+
+Include enough detail for maintainers to reproduce and assess the issue, such
+as the affected version or commit, configuration, steps to reproduce, impact,
+and any proof of concept. Do not include credentials, API keys, wallet data, or
+other sensitive information unless it is necessary and can be shared safely.
+
+Maintainers will acknowledge the report, investigate it, and coordinate a fix
+and disclosure timeline with you. Please allow time for a fix to be prepared
+before publicly disclosing the vulnerability.
+
+## Scope
+
+This policy covers the LNbits core repository and LNbits extensions in the LNbits GitHub organisation. Vulnerabilities in third-party
+funding sources, dependencies or hosted LNbits instances may need to be reported to their respective maintainers or
+operators as well.