docs: publish vulnerability remediation targets

SECURITY.md

@@ -32,6 +32,19 @@ After you submit a report, we will endeavor to:
 - Provide an estimated time frame for addressing the vulnerability.
 - Notify you when the issue is resolved.
 
+## Remediation Targets
+
+These targets apply to Cloud Posse's actively maintained software products, including the Atmos CLI.
+
+| Severity | Target |
+| --- | --- |
+| Critical | 7 days, or 72 hours where the vulnerability is reachable in the product and an upstream fix is available |
+| High | 30 days |
+| Medium | 90 days |
+| Low | Next regular release |
+
+Targets are measured from confirmation of the vulnerability rather than from the date it was reported.
+
 ## Supported Versions
 
 Given the nature of our open-source projects, we generally support only the latest major version of each project. However, critical security patches may be applied to older versions at our discretion.
@@ -43,4 +56,3 @@ We deeply value the contributions and efforts of security researchers and the wi
 We are committed to working with the community in a transparent and collaborative manner. We recognize the efforts of those who responsibly disclose vulnerabilities and will ensure they receive acknowledgment for their contributions in our project documentation or other public communications, as appropriate.
 
 Thank you for your support in keeping Cloud Posse and the open source ecosystem secure!
-