Add security policy, as requested by GitHub.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..f92ad75
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,13 @@
+# Security Policy
+
+## Supported Versions
+
+We are not maintaining multiple branches, so all fixes will be committed to head and included in the next release.
+
+We take great care to maintain backwards compatibility, so we expect our users to use the latest version.
+
+## Reporting a Vulnerability
+
+You can reach us per email at libzip@nih.at.
+
+For less sensitive reports, you can also open an issue or pull request on GitHub.
