Add github SECURITY.md security policy to opensrc repo

(Internal change: 2338550)

README.md

@@ -31,6 +31,8 @@ visit our [forum](https://groups.google.com/forum/#!forum/usd-interest).
 
 If you are experiencing undocumented problems with the software, please 
 [file a bug](https://github.com/PixarAnimationStudios/OpenUSD/issues/new).
+If you need to report a security issue with the software, please review the 
+[Security Policy](SECURITY.md).
 
 Supported Platforms
 -------------------

SECURITY.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+We appreciate your efforts to responsibly disclose your findings and will make 
+every effort to acknowledge your contributions.
+
+## Reporting a Vulnerability
+
+Please use the GitHub Security Advisory 
+["Report a Vulnerability" tab](https://github.com/PixarAnimationStudios/OpenUSD/security/advisories/new) 
+to report a security issue. Please do not report security vulnerabilities 
+through public issues, discussions, or change requests.
+
+The team will send a response indicating the next steps in handling your report. 
+After the initial reply to your report, the security team will keep you informed 
+of the progress towards a fix and may ask for additional information or guidance.
+
+Report security bugs in third-party plugins/applications to the team maintaining 
+the application.