SECURITY.md to publish vuln reporting process

[skip ci]

README.md

@@ -310,14 +310,22 @@ And the IRC channel is \#loofah on freenode.
 
 ## Security
 
-Some tools may incorrectly report loofah is a potential security
-vulnerability. Loofah depends on Nokogiri, and it's possible to use
-Nokogiri in a dangerous way (by enabling its DTDLOAD option and
-disabling its NONET option).  This dangerous Nokogiri configuration,
-which is sometimes used by other components, can create an XML
-External Entity (XXE) vulnerability if the XML data is not trusted.
-However, loofah never enables this dangerous Nokogiri configuration;
-loofah never enables DTDLOAD, and it never disables NONET.
+See [`SECURITY.md`](SECURITY.md) for vulnerability reporting details.
+
+
+### "Secure by Default"
+
+Some tools may incorrectly report Loofah as a potential security
+vulnerability.
+
+Loofah depends on Nokogiri, and it's _possible_ to use Nokogiri in a
+dangerous way (by enabling its DTDLOAD option and disabling its NONET
+option). This specifically allows the opportunity for an XML External
+Entity (XXE) vulnerability if the XML data is untrusted.
+
+However, Loofah __never enables this Nokogiri configuration__; Loofah
+never enables DTDLOAD, and it never disables NONET, thereby protecting
+you by default from this XXE vulnerability.
 
 
 ## Related Links

SECURITY.md

@@ -0,0 +1,18 @@
+# Security and Vulnerability Reporting
+
+The Loofah core contributors take security very seriously and investigate all reported vulnerabilities.
+
+If you would like to report a vulnerablity or have a security concern regarding Loofah, please [report it via HackerOne](https://hackerone.com/loofah/reports/new).
+
+Your report will be acknowledged within 24 hours, and you'll receive a more detailed response within 72 hours indicating next steps in handling your report.
+
+If you have not received a reply to your submission within 48 hours, there are a few steps you can take:
+
+* Contact the current security coordinator (Mike Dalessio <mike.dalessio@gmail.com>)
+* Email the Loofah user group at loofah@librelist.com (archive at http://librelist.com)
+
+Please note, the user group list is a public area. When escalating in that venue, please do not discuss your issue. Simply say that you're trying to get a hold of someone from the core team.
+
+The information you share with the Loofah core contributors as part of this process will be kept confidential within the team, unless or until we need to share information upstream with our dependent libraries' core teams, at which point we will notify you.
+
+If a vulnerability is first reported by you, we will credit you with the discovery in the public disclosure.