Your team maintains a public repository. A new maintainer asks where in the repository they should document the supported versions and the process external researchers should follow to privately report a discovered vulnerability. Which file should hold this information?