Add SECURITY.md

SECURITY.md

@@ -0,0 +1,32 @@
+# Security Policies and Procedures
+
+This document outlines security procedures and general policies for Python India's Junction
+project.
+
+- [Rules of Engagement](#rules-of-engagement)
+- [Reporting a Bug](#reporting-a-bug)
+
+## Rules of Engagement
+
+If you're interested in testing for bugs in Junction, do it on a local development server.
+Under no circumstance will you perform testing on the live site.
+
+
+## Reporting a Bug
+
+The Junction team takes all security bugs very seriously. We thank you for
+helping improve the security of Junction. Your efforts and responsible disclosure
+will be acknowledged.
+
+While reporting a bug, try to incorporate these points into your report:
+
+- **Title**: a one-line description of the bug
+- **Summary**: what is it, how did you find it
+- **Steps to reproduce**: how can we replicate this bug, use screenshots to aid your explaination
+- **Impact**: what functionality of Junction is affected
+
+Your email will be acknowledged within 48 hours, and you will be sent a 
+more detailed response indicating the next steps in handling your report.
+After the initial reply to your report, the security team will endeavor to keep
+you informed of the progress towards a fix and full disclosure,
+and may seek additional information or guidance from you.