docs: add security policy

SECURITY.md

@@ -0,0 +1,44 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are issued for the latest published release of `manifoldbt` on
+PyPI. Older versions are not patched; upgrade with `pip install -U manifoldbt`.
+
+## Reporting a vulnerability
+
+**Do not open a public issue for a security problem.**
+
+Use GitHub's private reporting: go to the **Security** tab of this repository
+and click **Report a vulnerability**. That opens a private advisory visible only
+to you and the maintainers.
+
+If you cannot use that, email **contact@manifoldbt.com** with `SECURITY` in the
+subject line.
+
+Please include:
+
+- the version of `manifoldbt` and of Python, and the operating system
+- what an attacker can do with the issue
+- a minimal reproduction, ideally a script that runs against public data
+
+## What to expect
+
+- Acknowledgement within 5 business days.
+- An assessment, with a fix timeline or an explanation of why it is not a
+  vulnerability, within 15 business days.
+- Credit in the release notes when a report leads to a fix, unless you prefer
+  otherwise.
+
+Please give us a reasonable window to publish a fix before disclosing publicly.
+
+## Scope
+
+In scope: the published `manifoldbt` package, its data connectors, and its CLI.
+
+Of particular interest: anything that lets untrusted input reach code execution.
+The library parses files and network responses that a user did not write,
+including CSV imports and connector payloads, and it deserializes stored data.
+
+Out of scope: the website, third-party forks and redistributions, and findings
+that require an attacker to already control the machine running the backtest.