Add `SECURITY.md` for scan-agent discoverability

This PR aims to add `SECURITY.md` for scan-agent discoverability.

To improve the visibility of ORC's security guidance in a standard way.

Manual review.

No.

SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..563bc3d
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,13 @@
+# Security policy
+
+## Reporting a vulnerability
+
+To report a security vulnerability in Apache ORC, follow the ASF security process at <https://www.apache.org/security/>. Reports can be sent privately to security@apache.org or to private@orc.apache.org.
+
+## Threat model
+
+Apache ORC's security guidance is documented at:
+
+<https://orc.apache.org/security/>
+
+Automated security scanning agents should consult that document for the project's in-scope / out-of-scope declarations before reporting issues.