Create SECURITY.md

upon request :-)

SECURITY.md

@@ -0,0 +1,29 @@
+# Security Policy
+
+## Supported Versions
+
+The following versions are currently being supported with security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 2.x.x   | :white_check_mark: |
+| < 2.0   | :x:                |
+
+## Reporting a Vulnerability
+
+Feel free to submit issues to info at mustangproject.org with [security] indicated in the subject. 
+We may ask back questions but we usually open (or communicate about) an issue (potentially in a private location you would be provided with access to) and decide on the severity within two working days. 
+
+Please indicate 
+* a proof of concept, if possible
+* If any of the information you submit, e.g. an invoice which can not be [anonymized](https://github.com/ZUGFeRD/einvoice-anonymizer), is confidential
+* A quick justification why you require a fix in a older version than he most up to date one, if you can not update to the most recent version
+* If you require encrypted communication (our GPG fingerprint will likely be 68F4 2269 8165 F0F5 63CA  A13B 7CB7 1548 B596 66A3)
+
+
+## After your Report
+
+We try to fix critical issues in less than a week, and release a fixed version in less than two weeks.
+
+Thank you for keeping our software safe!
+