Add a security policy (#6194)

The repository doesn't say how to report a vulnerability privately, and
#6185 was reported in a public issue. Point reporters to GitHub's
private vulnerability reporting.

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please don't report security vulnerabilities in public issues, discussions or pull requests.
+
+Instead, report them privately through GitHub. Go to the [Security tab](https://github.com/jesseduffield/lazygit/security) of this repository and click "Report a vulnerability". Only the maintainers can see your report.
+
+Please include:
+
+- the lazygit version (the output of `lazygit --version`) and your operating system
+- the steps to reproduce the problem, ideally as a script that sets up a repository
+- what an attacker can achieve with it
+
+## What happens next
+
+Lazygit is maintained by volunteers in their spare time. We can't promise a fixed response time, but we'll get back to you as soon as we can.
+
+If we confirm the vulnerability, we fix it in private and release a new version. Then we publish a security advisory, request a CVE for it through GitHub, and credit you in the advisory unless you prefer not to be named.
+
+## Supported versions
+
+We only fix security vulnerabilities in the latest release. Please check whether the problem still exists there before you report it.