docs: create SECURITY.md

Add draft security policy

Author: CyrusVorwald

SECURITY.md

@@ -0,0 +1,25 @@
+# Security Policy
+
+The ICON Bridge is in early development and may contain security vulnerabilities.
+
+## Security Audit
+
+The ICON Bridge is currently being audited. We will make the audit report public after it is complete
+and all discovered vulnerabilities have been addressed.
+
+## Bug Bounty
+
+TBD after audit completes.
+
+## Supported Versions
+
+Please see the [releases page](https://github.com/icon-project/icon-bridge/releases) for the list of supported version.
+
+## Reporting a Vulnerability
+
+All security related issues should be reported via email to security@icon.foundation. We will attempt to respond within 2 business days to all reported issues.
+
+## Fixing a Vulnerability
+
+Development for security issues should be done in a private fork and publicly commited ONLY after the fix is already on mainnet.
+[See Github's steps on how to develop in a private fork](https://docs.github.com/en/code-security/repository-security-advisories/collaborating-in-a-temporary-private-fork-to-resolve-a-repository-security-vulnerability).