core: add security policy in SECURITY.md

CONTRIBUTING.md

@@ -19,8 +19,7 @@ First, some basic things:
 
 ### Security reports
 
-Please **DO NOT** file a GitHub issue for security related problems, but send an
+Please **DO NOT** file a GitHub issue for security related problems; see [SECURITY.md](SECURITY.md) instead.
-email to [security@weechat.org](mailto:security@weechat.org) instead.
 
 ### Required info
 

SECURITY.md

@@ -0,0 +1,26 @@
+<!--
+SPDX-FileCopyrightText: 2026 Sébastien Helleu <flashcode@flashtux.org>
+
+SPDX-License-Identifier: GPL-3.0-or-later
+-->
+
+# Security Policy
+
+## Supported versions
+
+Only the latest stable version of WeeChat is supported.
+
+| Version        | Supported          | Notes                                               |
+| -------------- | ------------------ | --------------------------------------------------- |
+| Latest stable  | :white_check_mark: | Fully supported.                                    |
+| Older releases | :x:                | Not supported. Contact us in case of specific need. |
+
+However, we may help to backport fixes on older versions, especially when they are used in released distributions with no way to upgrade to the latest stable release (please contact us).
+
+## Reporting a vulnerability
+
+Please report security issues using <https://github.com/weechat/weechat/security/advisories/new>.
+
+Alternatively, if you are not able to use this form, you can send an email to [security@weechat.org](mailto:security@weechat.org) instead.
+
+We will investigate all legitimate reports and do our best to quickly fix the problem.