Update SECURITY.md

Author: wurstbrot

SECURITY.md

@@ -1,2 +1,24 @@
-Please contact timo.pagel@owasp.org in case you detect a vulnerability or flaw with severity high or critical in the application.
-In all other cases, please create an issue.
+# Responsible disclosure policy
+
+## Introduction
+
+We take security very seriously.
+We welcome any review of the latest release of all our open source code to ensure that these components can not be compromised.
+In case you identified a security related issue with severity of _low_ to _medium_, please create a GitHub issue. 
+
+
+## Security related bugs with severity _high_ or _critical_
+
+In case you identified a security related issue with severity of _high_ or _critical_, please disclose information about the issue non public via email to `timo.pagel@owasp.org`.
+
+We encourage researchers to include a Proof-of-Concept, supported by screenshots or videos.
+For each given security related issue with severity _high_ or _critical_ (based on SDA SE own assessment), we will respond within one week.
+
+
+# Supported versions and update policy
+
+Please be aware that only the most recent version will be subject of security patches.
+
+# Known security gaps and future enhancements
+
+There is no format in commits to identify security related fixes and it is not planned yet.