Create SECURITY.md

Closes bazelbuild#13911.

PiperOrigin-RevId: 393361598

README.md

@@ -42,6 +42,15 @@ Build and test software of any size, quickly and reliably.
   * [Roadmap](https://bazel.build/roadmap.html)
   * [Who is using Bazel?](https://github.com/bazelbuild/bazel/wiki/Bazel-Users)
 
+## Reporting a Vulnerability
+
+To report a security issue, please email security@bazel.build with a description
+of the issue, the steps you took to create the issue, affected versions, and, if
+known, mitigations for the issue. Our vulnerability management team will respond
+within 3 working days of your email. If the issue is confirmed as a
+vulnerability, we will open a Security Advisory. This project follows a 90 day
+disclosure timeline.
+
 ## Contributing to Bazel
 
 See [CONTRIBUTING.md](CONTRIBUTING.md)

SECURITY.md

@@ -0,0 +1,10 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+To report a security issue, please email security@bazel.build with a description
+of the issue, the steps you took to create the issue, affected versions, and, if
+known, mitigations for the issue. Our vulnerability management team will respond
+within 3 working days of your email. If the issue is confirmed as a
+vulnerability, we will open a Security Advisory. This project follows a 90 day
+disclosure timeline.