Add security policy, post-v1.0 MSRV bump policy

fearless_simd/README.md

@@ -233,8 +233,10 @@ It benefited from conversations with Luca Versari, though he is not responsible
 
 This version of Fearless SIMD has been verified to compile with **Rust 1.89** and later.
 
-Future versions of Fearless SIMD might increase the Rust version requirement.
-It will not be treated as a breaking change and as such can even happen with small patch releases.
+Future versions of Fearless SIMD might increase the Rust version requirement. This will be accompanied by a minor version bump.
+
+If you require a fixed MSRV, we recommend using Cargo's [MSRV-aware resolver](https://doc.rust-lang.org/edition-guide/rust-2024/cargo-resolver.html) which will not select a version that fails to build.
+We will provide [security backports](SECURITY.md) to older Rust versions released within the last 3 years.
 
 ## Community
 

fearless_simd/SECURITY.md

@@ -0,0 +1,20 @@
+# Security Policy
+
+## Supported Versions
+
+Starting with v1.0, we will provide security backports for the latest version of Fearless SIMD for each MSRV (minimum supported Rust version) for *at least* 3 years since its MSRV was released.
+
+This ensures that security updates are just a `cargo update` away, no matter what Rust compiler version you use (as long as it's not older than 3 years).
+
+As an example: if (hypothetically) both 1.0.x and 1.1.x have an MSRV of 1.89, while 1.2.x has MSRV of 1.100, both 1.1.x and 1.2.x will receive security backports, while 1.0.x will not because a fixed version with the same MSRV is already available and will be fetched by `cargo update`. If v2.0.0 is released, versions in v1.x.x series will continue receiving security backports as per the above policy.
+
+Earlier versions may or may not receive security backports at the discretion of Fearless SIMD maintainers.
+
+You can look up when each Rust version was released in the [Rust Release Notes](https://doc.rust-lang.org/stable/releases.html).
+
+## Reporting a Vulnerability
+
+This repository follows a full disclosure policy. Please report security issues publicly on the Github issue tracker.
+
+Entirely AI-generated reports are not permitted. While the use of LLMs for auditing code is welcome,
+the issue must be reproduced and understood by a human before reporting.