Update SECURITY.md

SECURITY.md

@@ -2,13 +2,16 @@
 
 ## Supported Versions
 
-All development is based done against the current head of the master branch,
-with releases being tagged periodically.
+All development is done against the current head of the master branch,
+with a single train of releases being tagged from the master branch 
+regularly and often. Bug fixes are not backported to old versions.
 
 ## Reporting a Vulnerability
 
-For BWIPP, most security bugs are "just bugs" so report them openly via the
+For BWIPP, most security bugs are "just bugs", so report them openly via the
 issue tracker.
 
 If you determine that the issue is so serious as to place users' systems at
-grave risk then feel free to contact the author directly.
+grave risk then feel free to contact the author directly. But it is unlikely
+to result in coordinated disclosure: The ecosystem is too diverse with the
+code finding itself in many esoteric places.