Create SECURITY.md

SECURITY.md

@@ -0,0 +1,25 @@
+⚠️ PLEASE DON'T DISCLOSE SECURITY-RELATED ISSUES PUBLICLY, SEE BELOW.
+
+If you have found a security issue in Bolt, please send the details to
+security@boltcms.io and don't disclose it publicly until we can provide a fix 
+for it. If you wish, we'll credit you for finding verified issues, when we 
+release the patched version.
+
+A note on "Self XSS"
+--------------------
+
+Bolt is a CMS, that allows users to edit content on a website. As such,
+all _authenticated users_ can:
+
+ - Edit content, and (depending on the field types) insert HTML and CSS in that
+   content, with a variety of allowed attributes.
+ - Depending on the user level: Edit template files, and insert HTML, CSS and
+   javascript in those.
+ - Upload files to the site, which will become publicly available. In the
+   default settings, this includes `.PDF` and `.SVG` files.
+
+We see these functionalities as _features_, and not as security issues. Please
+report the mentioned items only if they can be performed by non-authorized
+users, or other exploitable vulnerabilities.
+
+Thanks!