Add security file.

README.md

@@ -1164,7 +1164,7 @@ Please see [CONTRIBUTING](CONTRIBUTING.md) and [CODE_OF_CONDUCT](CODE_OF_CONDUCT
 
 ## Security
 
-If you discover any security related issues, please email larry at garfieldtech dot com instead of using the issue tracker.
+If you discover any security related issues, please use the [GitHub security reporting form](https://github.com/Crell/Serde/security) rather than the issue queue.
 
 ## Credits
 

SECURITY.md

@@ -0,0 +1,37 @@
+# Brand Promise
+
+Perfect security is not an achievable goal, but it is a goal to strive for nonetheless.  To that end, we welcome responsible security reports from both users and external security researchers.
+
+# Scope
+
+If you believe you've found a security issue in software that is maintained in this repository, we encourage you to notify us.
+
+| Version | In scope | Source code                    |
+| ------- | -------- |--------------------------------|
+| latest  | ✅ | https://github.com/Crell/Serde |
+
+Only the latest stable release of this library is supported.  In general, bug and security fixes will not be backported unless there is a substantial imminent threat to users in not doing so.  
+
+# How to Submit a Report
+
+To submit a vulnerability report, please contact us through [GitHub](https://github.com/Crell/Serde/security). Your submission will be reviewed as soon as feasible, but as this is a volunteer project we cannot guarantee a response time.
+
+# Safe Harbor
+
+We support safe harbor for security researchers who:
+
+* Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services.
+* Only interact with accounts you own or with explicit permission of the account holder. If you do encounter Personally Identifiable Information (PII) contact us immediately, do not proceed with access, and immediately purge any local information.
+* Provide us with a reasonable amount of time to resolve vulnerabilities prior to any disclosure to the public or a third-party.
+
+We will consider activities conducted consistent with this policy to constitute "authorized" conduct and will not pursue civil action or initiate a complaint to law enforcement. We will help to the extent we can if legal action is initiated by a third party against you.
+
+Please submit a report to us before engaging in conduct that may be inconsistent with or unaddressed by this policy.
+
+# Preferences
+
+* Please provide detailed reports with reproducible steps and a clearly defined impact.
+* Include the version number of the vulnerable package in your report.
+* Providing a suggested fix is welcome, but not required, and we may choose to implement our own, based on your submitted fix or not.
+* This is a volunteer project. We will make every effort to respond to security reports in a timely manner, but that may be a week or two on the first contact.
+