Create SECURITY.md

SECURITY.md

@@ -0,0 +1,27 @@
+## Overview
+
+We welcome reports from the security community and are committed to working collaboratively to investigate and resolve vulnerabilities responsibly.
+
+---
+
+## Reporting a Potential Vulnerability
+
+If you find a security vulnerability please submit details through [Bugzilla](https://bugzilla.mozilla.org/enter_bug.cgi?product=addons.mozilla.org). Always submit potential security vulnerabilities via the [webform](https://bugzilla.mozilla.org/enter_bug.cgi?product=addons.mozilla.org); _never_ submit security-related bugs through a Github Issue or by email.
+
+### addons.mozilla.org (AMO)
+
+If your security vulnerability is potentially exploitable via [AMO](https://addons.mozilla.org), you may be eligible for our [bug bounty program](https://www.mozilla.org/en-US/security/web-bug-bounty/) [[FAQ](https://www.mozilla.org/en-US/security/bug-bounty/faq-webapp/)].
+
+### What to include
+
+To help us triage quickly, please provide:
+
+- A clear description of the issue
+- Steps to reproduce (or a proof of concept)
+- Affected versions / environments
+- Potential impact (what an attacker could achieve)
+- Any suggested mitigations or fixes
+
+### Non-security bugs
+
+Other bugs, that have no potential security implications, can be submitted via the [issue tracker](../../issues/new).