Create SECURITY.md (#3639)

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+Use this section to tell people about which versions of your project are
+currently being supported with security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| jib-maven-plugin v3.x   | :heavy_check_mark: |
+| jib-gradle-plugin v3.x   | :heavy_check_mark:                |
+| jib-core v0.x  | :heavy_check_mark:                |
+| jib-cli v0.x   | :heavy_check_mark:                |
+
+
+## Reporting a Vulnerability
+
+To report a security issue, please use [https://g.co/vulnz](https://g.co/vulnz).
+We use g.co/vulnz for our intake, and do coordination and disclosure here on
+GitHub (including using GitHub Security Advisory). The Google Security Team will
+respond within 5 working days of your report on g.co/vulnz.