NIH Data Call: inject public repository security policy into SECURITY.md

Author: nciespm-automation-app[bot]

SECURITY.md

@@ -0,0 +1,19 @@
+# NCI Standard Public Repository Security Policy
+
+## Maintained Versions
+
+Actively maintained versions of contained software will vary from repository to repository, or may not be relevant at all.  
+The developers of this repository will update this section if any actively maintained versions of the software need to be publicly disclosed. Otherwise, contact the developers directly for any version information.
+
+## Vulnerability Disclosure:
+
+### Option 1: HHS Vulnerability Disclosure
+
+Follow the instructions listed in the [HHS vulnerability disclosure policy](https://www.hhs.gov/vulnerability-disclosure-policy/index.html).
+
+### Option 2: Private Vulnerability Report
+
+1. Click on the **Security and quality** tab of this repository.
+2. Locate the **Report a vulnerability** button. If the button is not on the **Security and quality** landing page, look under the **Advisories** section in the side bar.
+3. Click the **Report a vulnerability** button and submit the form. The developers will receive a notification of your submission.
+