docs: add `SECURITY.md`

SECURITY.md

@@ -0,0 +1,9 @@
+# Reporting Security Issues
+
+If you discover a security issue in webpack, please report it by sending an
+email to [webpack@opencollective.com](mailto:webpack@opencollective.com).
+
+This will allow us to assess the risk, and make a fix available before we add a
+bug report to the GitHub repository.
+
+Thanks for helping make webpack safe for everyone.

package.json

@@ -88,7 +88,8 @@
     "buildin/",
     "hot/",
     "web_modules/",
-    "schemas/"
+    "schemas/",
+    "SECURITY.md"
   ],
   "scripts": {
     "setup": "node ./setup/setup.js",