Added security policy

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+***DO NOT CREATE AN ISSUE*** to report a vulnerability.
+
+Instead, please send an email to todo-security@example.com. 
+See [Responsible Disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure) for more details.
+
+### Procedure
+
+1.  After you send an email to todo-security@example.com, you should receive a response from the [Prism team](https://github.com/orgs/PrismJS/people) within 3 days. 
+
+    We may require further information, so please keep in touch with us until the vulnerability has been fixed.
+
+2.  After the vulnerability has been confirmed and accepted, we will create a [security advisory](https://docs.github.com/en/code-security/security-advisories/about-github-security-advisories) and start working on a fix. 
+
+    You will be [added as a collaborator](https://docs.github.com/en/code-security/security-advisories/adding-a-collaborator-to-a-security-advisory) (this requires a GitHub account). 
+    At this point, all communication will occur using comments on the advisory and the [temporary private fork](https://docs.github.com/en/code-security/security-advisories/collaborating-in-a-temporary-private-fork-to-resolve-a-security-vulnerability).
+
+3.  After the fix has been merged, we will make a new release and publish the security advisory within one week.