Add SECURITY.md (Security Policy) (#9078)

Author: eksperimental

RELEASE.md

@@ -30,7 +30,7 @@
 
 1. Set `CANONICAL=` in /Makefile
 
-2. Update tables in "Compatibility and Deprecations"
+2. Update tables in /SECURITY.md and "Compatibility and Deprecations"
 
 3. Commit "Prepare vMAJOR.MINOR for release"
 

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Supported versions
+
+Elixir applies bug fixes only to the latest minor branch. Security patches are available for the last 5 minor branches:
+
+| Elixir version | Support
+| -------------- | ------------------------------
+| 1.9            | Bug fixes and security patches
+| 1.8            | Security patches only
+| 1.7            | Security patches only
+| 1.6            | Security patches only
+| 1.5            | Security patches only
+
+## Announcements
+
+New releases are announced in the read-only [announcements mailing list](https://groups.google.com/group/elixir-lang-ann). You can subscribe by sending an email to elixir-lang-ann+subscribe@googlegroups.com and replying to the confirmation email.
+
+All security releases [will be tagged with `[security]`](https://groups.google.com/forum/#!searchin/elixir-lang-ann/%5Bsecurity%5D%7Csort:date).
+
+## Reporting a vulnerability
+
+Please disclose security vulnerabilities privately at elixir-security@googlegroups.com