Added SECURITY.md with EOL notice

Author: squidfunk

SECURITY.md

@@ -0,0 +1,37 @@
+# Security policy
+
+## Reporting a vulnerability
+
+We take the security of Material for MkDocs seriously. If you believe you have found a security vulnerability in Material for MkDocs, we encourage you to report it to us responsibly.
+
+**Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.**
+
+Instead, please send a report to martin.donath@squidfunk.com with the following information:
+
+1. A description of the vulnerability and its potential impact.
+2. The steps required to reproduce the issue.
+3. Any relevant files, screenshots, or proof-of-concept code.
+4. Your name and contact information, if you would like to be credited.
+
+## Our commitment
+
+We are committed to working with security researchers and our community to address vulnerabilities quickly and transparently. When you submit a report, you can expect the following:
+
+- **Acknowledgement** within 3 business days of your report.
+- **Regular updates** on our progress as we investigate and address the issue.
+- **Confidentiality** – we will not share your personal information without your permission, and we ask that you keep the vulnerability confidential until we have had the opportunity to address it.
+- **Credit** – we are happy to acknowledge your contribution once the vulnerability has been resolved, if you would like.
+
+## Supported versions
+
+We release security fixes for the latest stable version of Material for MkDocs until its end-of-life date on **November 5, 2025**. We encourage all users to stay up to date with the latest release to ensure they benefit from all security patches.
+
+After **November 5, 2025**, Material for MkDocs will no longer receive public security updates as part of standard maintenance.
+
+Organizations with longer support requirements are welcome to contact us at martin.donath@squidfunk.com to discuss potential extended support options.
+
+## Scope
+
+This policy applies to vulnerabilities in the Material for MkDocs codebase. If you discover a vulnerability in a third-party dependency, please report it to the maintainers of that project directly.
+
+We take dependency security seriously. We are deliberate in our selection of third-party dependencies, and we actively monitor and update them to ensure Material for MkDocs remains on the latest stable versions. If you believe a dependency we use poses a security risk, feel free to bring it to our attention at martin.donath@squidfunk.com.