Add SECURITY.md (#11)

GitHub will include a link to this file as part of its issue reporting
flow so that users will know this is the best way to report security
issues.

Author: jparise

README.md

@@ -8,6 +8,7 @@ etc.
 - [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md) - code of conduct
 - [`CONTRIBUTING.md`](CONTRIBUTING.md) - contributing guide
 - [`LICENSE`](LICENSE) - our standard [Apache 2.0 license](https://www.apache.org/licenses/LICENSE-2.0)
+- [`SECURITY.md`](SECURITY.md) - security policy
 
 ## Licensing
 

SECURITY.md

@@ -0,0 +1,9 @@
+# Reporting Security Issues
+
+If you discover a security issue in this project, please report it using
+[Bugcrowd](https://bugcrowd.com/pinterest).
+
+This will allow us to assess the risk and make a fix available before we
+publish a public bug report.
+
+Thanks for helping us make our software safe for everyone!