Add missing files

Author: joel-rieke

CODEOWNERS

@@ -0,0 +1 @@
+* @joel-rieke @meghan-bailey @mkrty @JoshuaAtTrimble

SECURITY.md

@@ -1,8 +1,17 @@
 # Security Policy
 
 ## Reporting a Vulnerability
-Security issues and bugs should be reported privately, via email, to [cybersecurity@trimble.com](mailto:cybersecurity@trimble.com).
 
-If you do not receive a response within 24 hours, please follow up via email to ensure we received your original message.
+Report security vulnerabilities by emailing the Trimble Cybersecurity team at:
 
-Please do not open issues for anything you think might have a security implication.
+    cybersecurity@trimble.com
+
+Report security vulnerabilities in third-party modules to the person or team maintaining the module.
+
+## Disclosure Policy
+
+When the security team receives a security bug report, they will assign it to a primary handler. This person will coordinate the fix and release process, involving the following steps:
+
+- Confirm the problem and determine the affected versions.
+- Audit code to find any potential similar problems.
+- Prepare fixes for all releases still under maintenance. These fixes will be released as fast as possible.