docs: add SECURITY.md

.github/SECURITY.md

@@ -0,0 +1,34 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+Instead, please report it in a private conversation with one or more of our maintainers [on Discord](https://discord.gg/yyKns29zch).
+
+Please encrypt your message to us using our PGP key. The key fingerprint is:
+
+```
+A656 0650 74D2 6C7D CF6E D0F4 0784 3C69 92BF C9FA
+```
+
+The key is available from [keyserver.ubuntu.com](https://keyserver.ubuntu.com/pks/lookup?search=0xA656065074D26C7DCF6ED0F407843C6992BFC9FA&fingerprint=on&op=index).
+
+Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
+
+- Full paths of source file(s) related to the manifestation of the issue
+- The location of the affected source code (tag/branch/commit or direct URL)
+- Any special configuration required to reproduce the issue
+- Step-by-step instructions to reproduce the issue
+- Proof-of-concept or exploit code (if possible)
+- Impact of the issue, including how an attacker might exploit the issue
+
+Please get in touch and give the project contributors a chance to resolve the vulnerability and issue a new release prior to any public exposure; this helps protect the project's users and provides them with a chance to upgrade and/or update in order to protect their applications.
+
+## Preferred Languages
+
+We prefer all communications to be in English.
+
+## Policy
+
+`cron` follows the principle of [Coordinated Vulnerability Disclosure](https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html#responsible-or-coordinated-disclosure).