Add security policy for responsible vulnerability disclosure

SECURITY.md

@@ -0,0 +1,54 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+We take security vulnerabilities seriously. If you believe you've discovered a security issue in js-beautify, please report it responsibly using GitHub's Private Vulnerability Reporting feature.
+
+### How to Report
+
+**DO NOT** open a public GitHub issue for security vulnerabilities.
+
+Instead, use the private reporting feature:
+1. Go to the [Security tab](../../security/advisories)
+2. Click "Report a vulnerability"
+3. Fill out the form with details of the vulnerability
+4. Submit your report
+
+This creates a private communication channel between you and the maintainers.
+
+### What to Include in Your Report
+
+Please provide:
+- Description of the vulnerability
+- Steps to reproduce (or proof-of-concept)
+- Affected versions
+- Suggested remediation (if you have one)
+- Your contact information (optional)
+
+### Response Timeline
+
+- **Initial Response**: Within 48 hours of submission
+- **Updates**: We'll keep you informed of progress toward a fix
+- **Disclosure Coordination**: We'll work with you on timing for public disclosure
+
+### Security Best Practices
+
+When using js-beautify:
+- Keep the package updated to the latest version
+- Validate and sanitize all input data before beautifying
+- Don't beautify untrusted code or markup in security-critical contexts
+
+## Security Advisories
+
+Once a vulnerability is patched:
+- We'll publish a security advisory on GitHub
+- Release notes will credit the researcher (unless requested otherwise)
+- Users will be notified via GitHub's security alerts
+
+## Questions?
+
+For questions about this policy, please open a regular (non-security) GitHub issue.
+
+---
+
+Thank you for helping keep js-beautify secure! 🙏