Add SECURITY.md referencing EVE security policy

SECURITY.md

@@ -0,0 +1,26 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+The EVE community takes security seriously. If you discover a security
+issue, please bring it to our attention right away.
+
+Please DO NOT file a public issue. Report it privately instead, either by
+email to [eve-security@lists.lfedge.org][mail] or through GitHub's
+[private vulnerability reporting][gh-report] on the EVE repository.
+
+## Project-Wide Security Policy
+
+This repository is part of the EVE project and is covered by the
+project-wide security policy maintained in the main EVE repository:
+
+- [SECURITY.md][policy] for supported versions, what to include in a
+  report, response timeline, and the coordinated disclosure process.
+- [SECURITY-ARCHITECTURE.md][arch] for the EVE security model.
+- [CONTRIBUTING.md][contrib] for contribution guidelines.
+
+[mail]: mailto:eve-security@lists.lfedge.org
+[gh-report]: https://github.com/lf-edge/eve/security/advisories/new
+[policy]: https://github.com/lf-edge/eve/blob/master/SECURITY.md
+[arch]: https://github.com/lf-edge/eve/blob/master/docs/SECURITY-ARCHITECTURE.md
+[contrib]: https://github.com/lf-edge/eve/blob/master/CONTRIBUTING.md