In office hours today, we discussed that we've started using https://github.com/osquery/osquery/security to track things. As such, we should backfill that with content from [SECURITY.md](https://github.com/osquery/osquery/blob/master/SECURITY.md)