Add security policy for responsible vulnerability disclosure

[Shweta-rani05]

🔒 Security: Enable Responsible Vulnerability Disclosure

Fixes #2522

Problem

Security researchers cannot responsibly disclose vulnerabilities because:

• No SECURITY.md file with clear disclosure guidelines exists
• Private Vulnerability Reporting needs to be enabled by maintainers

Solution

✅ Added comprehensive SECURITY.md file with:

• Clear vulnerability reporting instructions
• Direction to GitHub's Private Vulnerability Reporting feature
• 48-hour initial response timeline
• Security best practices for users
• Coordinated disclosure process

Why This Matters

This allows security professionals like @mohammedix88 to report vulnerabilities privately, protecting users from exploitation before fixes are available.

Next Steps for Maintainers

1. Enable Private Vulnerability Reporting in Settings → Security & analysis
2. Researcher can then submit vulnerability details via the "Report a vulnerability" button
3. Coordinated fix and disclosure begins

Standards Alignment

• OWASP vulnerability disclosure guidelines
• Industry standard OSS security practices
• Responsible disclosure principles

References

• Issue Security: request to open a private disclosure channel #2522: Security researcher requesting private disclosure channel
• Reporter: @mohammedix88 (CyStack Red Team)