Add SECURITY.md

Fixes eclipse-theia#8795

Signed-off-by: Marc Dumais <[email protected]>

SECURITY.md

@@ -0,0 +1,11 @@
+## Security Policy
+
+Eclipse Theia is an Eclipse Foundation project. We follow the Foundation's [Security Policy](https://www.eclipse.org/security/policy.php). Find more information on the Foundation's main [security page](https://www.eclipse.org/security/).
+
+## How to report a vulnerability
+
+If you believe you have found a new, as-of-yet undisclosed vulnerability in our project, please do not open an issue about it on GitHub. Instead report it to the [Eclipse Foundation security team](https://www.eclipse.org/security/).
+
+Make sure to provide a concise description of the issue, a [CWE](https://cwe.mitre.org/), and other supporting information. Identify the specific versions that are aware are affected.
+
+Describe the circumstances under which a CVE will be requested.