doc: add security.md

Change-Id: Ib7274cb084dfea9c0af79f3d27c49fd4581b1f14

Author: PapaPiya

README.md

@@ -17,6 +17,10 @@ This project is an official Go SDK extension package provided by APMPlus, design
 |----------------------------------------------------|---------| ------ |
 | [trpc](instrumentation/trpc.group/trpc-go/oteltrpc) | ✓ | ✓ |
 
+## Security and privacy
+This project takes security seriously.
+For vulnerability reporting and supported versions, see [SECURITY.md](SECURITY.md).
+
 ## License
 
 This project is licensed under the [Apache-2.0 License](LICENSE). 

SECURITY.md

@@ -0,0 +1,27 @@
+## Security and privacy
+
+If you discover potential security issues in the pproject, or believe you may have
+found a security issue, please notify the ByteDance security team through our
+[security center](https://security.bytedance.com/ssrc/) or [vulnerability reporting
+email](mailto:src@bytedance.com). Please do not create public GitHub Issues.
+
+We will assess the vulnerability based on the Common Vulnerability Scoring System
+(CVSS 3.1). The security team will keep you updated on key progress and may request
+further information or guidance from you. You are welcome to contact us via the email
+or website mentioned above to ask questions or discuss disclosure matters.
+
+To protect the security of our customers, ByteDance requests that you do not publish
+or share information regarding the vulnerability iin any public forum, nor publish or
+share data involving users, until the vulnerability has been remediated and our users
+have been notified. Please understand that the time required for remediation depends
+on the severity of the vulnerability and the scope of the impact.
+
+Individuals, companies, and security teams may wish to publish security advisories on
+their own websites or other forums. Please contact us via the email or website
+mentioned above prior to publication to discuss the information that can be disclosed
+and to coordinate the disclosure timeline.
+
+## Bug Bounty Reward
+
+[For the policy of bug bounty reward](https://bytedance.larkoffice.com/docx/ZstQd7bbooDctqxBCAmcFasOngd), if you have any
+questions about the rules, please contact [https://src.bytedance.com/home](https://src.bytedance.com/home) for consultation.