chore: add SECURITY.md

SECURITY.md

@@ -0,0 +1,29 @@
+# Security Policy
+
+## Reporting a Security Vulnerability
+
+If you believe you have found a security vulnerability in `ibc-rs`, you can
+privately report it via the project's [**Security** tab][ibc-rs-security] using
+[GitHub's private vulnerability reporting system][gh-vulnerability].
+
+> [!IMPORTANT]
+> Please **DO NOT** file a public issue in this repository to report a security
+> vulnerability.
+
+### Guidelines
+
+Please respect the following when reporting a security vulnerability:
+
+- Submit only one unique report per vulnerability.
+- Explain the vulnerability in detail and add any known exploits.
+- Leave an e-mail address for further follow-up questions.
+
+Please avoid or refrain from the following:
+
+- Share the vulnerability details publicly until the issue is resolved.
+- Post personal data or any sensitive information in the report.
+- Exploit the vulnerability to cause any damage or disruption to production
+  systems or destruction of production data.
+
+[ibc-rs-security]: https://github.com/cosmos/ibc-rs/security
+[gh-vulnerability]: https://docs.github.com/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability