Update SECURITY.md to use GitHub for security issue reporting

On-behalf-of: SAP <marvin.beckers@sap.com>
Signed-off-by: Marvin Beckers <marvin@kubermatic.com>

Author: embik

SECURITY.md

@@ -1,3 +1,17 @@
 # Security Process for kube-bind
 
-TBD
+## Reporting a Vulnerability
+
+kube-bind uses GitHub to allow submission of private security reports. Please report any security finding via
+[this link](https://github.com/kube-bind/kube-bind/security/advisories/new).
+Maintainers will triage your report as soon as possible and get in touch with you via your report or via email in case they have more questions.
+
+As a security researcher, please report vulnerabilities to kube-bind in a [coordinated vulnerability disclosure](https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html)
+fashion. In return, maintainers pledge to engage in good faith and collaborate with security researchers to address and publish vulnerabilities found in kube-bind as soon as possible.
+
+Please understand that the maintainers also do not accept results of dependency scanners without proof that the detected CVE / vulnerability can be used against kube-bind.
+
+## Security Advisories
+
+Advisories are managed through GitHub. Public disclosure of vulnerabilities happens through GitHub.
+Please visit [Security Advisories](https://github.com/kube-bind/kube-bind/security/advisories) to review security bulletins published by the maintainers.