docs: add blog post 2025-03-17-security-policy-update

- Related: yeoman/.github#21
- Related: yeoman/.github#1

Author: UlisesGascon

app/_posts/blog/2025-03-17-security-policy-update.md

@@ -0,0 +1,37 @@
+---
+layout: blog
+title: How Yeoman is Enhancing Security Through Policy Updates
+---
+
+This is just the start. We're also working on a **deeper security initiative** to strengthen Yeoman for the long haul. If you're curious or want to contribute, check out the discussion [here](https://github.com/yeoman/.github/issues/1).
+
+---
+We're not just dusting off old code. As part of our **[Maintenance Reboot Initiative](https://yeoman.io/blog/maintenance-reboot)**, we're rebuilding Yeoman for the future—stronger, faster, and definitely more secure. 
+
+That’s why we’ve rolled out an updated **[Security Policy](https://github.com/yeoman/.github/blob/main/SECURITY.md)** to keep our ecosystem locked down tight. If you're into open source (and we know you are), here's how you can help keep Yeoman secure.
+
+## How to Report a Vulnerability (Without Blowing Up the Internet)
+
+- **Found something shady?**  
+  - **Step 1:** **Do NOT open a public issue!** 
+  - **Step 2:** Report it privately through [GitHub Security Advisory](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability).  
+  - **Step 3:** Can’t use GitHub? Check the [security policy](https://github.com/yeoman/.github/blob/main/SECURITY.md) for an alternative option.
+
+Why private? Because public issues can give attackers a head start, and we’re not here for that.
+
+## What Happens After?
+
+- You'll hear from us within **2–5 working days** (we're fast, but coffee breaks exist).  
+- We aim to squash confirmed vulnerabilities within **30 days**—complex issues might take a bit longer.  
+- You’ll be looped in throughout the process. Transparency is key.  
+- Once fixed, we’ll shout out your name (if you want) as a thank-you!
+
+## Rewards? Not Yet. Recognition? Absolutely.
+
+No, there’s no bug bounty (for now). But responsible disclosures get you serious street cred in the Yeoman community. We’ll acknowledge your contributions (with your consent) after a fix is out. 
+
+
+**Happy hacking 🎩**
+
+– The Yeoman Maintainers Team  
+[@UlisesGascon](https://github.com/UlisesGascon) and [@JoshuaKGoldberg](https://github.com/JoshuaKGoldberg)