Create SECURITY.md

[zidingz]

A simple instruction for security researchers.

[ragarcia-vn]

For your information:
Older versions 1.x.x of the npm package postcss-replace are using deep-get-set as internal dependency. See https://www.npmjs.com/package/postcss-replace/v/1.1.2?activeTab=dependencies (the fantastic world of NPM dependencies)

If NPM downloads the newest deep-get-set release 1.1.2, then the command "stencil build" fails for my demo project with errors like
ERROR postcss: src/globals/scss/styles.css: src/globals/scss/styles.css undefined

It doesn't happen if I use the previous package deep-get-set "1.1.1"
Surely nowadays few people will use obsolete versions of postcss, stencil and more, so I deserve to have had this issue... but just in case you are aware of it now :)

[acstll]

Surely nowadays few people will use obsolete versions of postcss, stencil and more, so I deserve to have had this issue... but just in case you are aware of it now :)

arrgh, that's so annoying. I tried being very careful not to make any breaking changes… I should have released v2 directly.

@ragarcia-vn would it be possible for you to share your demo project? I would like to try and reproduce the error and give it a shot at figuring out what happened. I do know somebody using an old version of Stencil ;)

Thanks a lot for posting.