docs: add SECURITY.md with private vulnerability reporting process (#3126)

[yyyCode]

Description

Fixes #3126.

The repository currently has no SECURITY.md, no documented security contact, and no advertised private disclosure channel. As raised in #3126, this leaves security researchers with no responsible way to report vulnerabilities privately — the only options are public issues/discussions, which expose the vulnerability before a fix exists.

This PR adds a SECURITY.md at the repository root (GitHub automatically surfaces it under the Security tab and the "Report a vulnerability" flow). It documents:

• Supported versions — latest release and main.
• How to report — GitHub Private Vulnerability Reporting as the preferred private channel, with a placeholder for a security email as a fallback.
• What to include in a report (impact, affected version/component, reproduction steps, PoC, suggested fix).
• Response process — acknowledgement, assessment, coordinated fix/disclosure, and optional credit.

Notes for maintainers

Two things need your input, marked with HTML comments in the file so they don't render:

1. To make the preferred channel work, please enable Private vulnerability reporting under Settings → Security → Advanced Security.
2. If you'd like to offer an email fallback, drop the official security contact address into the marked spot (currently a placeholder TODO).

Happy to adjust the wording, supported-version table, or response-time expectations to match the team's actual process.

How Has This Been Tested?

Documentation-only change. Verified the file renders as valid Markdown and that no SECURITY.md previously existed in the repo root or .github/.

Checklist:

• My code follows the style guidelines of this project
• I have already rebased the commits and make the commit message conform to the project standard.
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• Any dependent changes have been merged and published in downstream modules

[coderabbitai]

📝 Walkthrough

Summary

Adds a root-level SECURITY.md with a private vulnerability reporting process. It documents supported versions, GitHub Private Vulnerability Reporting, the fallback security email, required report details, response steps, coordinated disclosure, and researcher credit.

Scope

• Affects repository documentation only.
• Adds no public APIs, packages, runtime configuration, or data.
• Maintainer notes request enabling GitHub Private Vulnerability Reporting and adding an official security contact.

Risks

• No correctness, compatibility, or performance risks are introduced.
• The fallback email and private reporting channel require maintainer configuration before they are operational.
• The documented support policy may become outdated if release practices change.

Verification

• No automated tests apply to this documentation-only change.
• Verify the file content and repository diff:

cat SECURITY.md
git diff --check
git diff --stat

Walkthrough

The change adds SECURITY.md with supported-version coverage, private vulnerability reporting channels, required report details, response expectations, disclosure guidance, and researcher credit.

Changes

Security Policy

Layer / File(s)	Summary
Security reporting and response policy SECURITY.md	Adds the project security policy, including private GitHub reporting, email fallback instructions, triage requirements, and the acknowledgement, assessment, remediation, disclosure, and credit process.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The PR documents the process but leaves Private Vulnerability Reporting disabled and the security email as TODO, so issue #3126 is not fully addressed.	Enable GitHub Private Vulnerability Reporting or provide an official security email, then replace the placeholder and confirm the private channel is available.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The change adds only the requested root-level security documentation and related maintainer instructions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title uses the required Conventional Commit format and clearly describes the SECURITY.md documentation change.
Description check	✅ Passed	The description covers the change, issue, motivation, testing, context, and checklist; snapshots are not applicable to this documentation-only change.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

SECURITY.md (1)

26-34: 🔒 Security & Privacy | 🔵 Trivial

Verify that GitHub Private Vulnerability Reporting is enabled before publishing this policy.

SECURITY.md only documents the required setting. It does not enable the feature. Confirm that repository administrators enabled it and that an external researcher can see Report a vulnerability. GitHub documents this action as available only after the repository setting is enabled. (docs.github.com)

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 31c19873-3ec2-4a0a-8ee0-f62efac2f054

📥 Commits

Reviewing files that changed from the base of the PR and between 31b49dd and 5107314.

📒 Files selected for processing (1)

• SECURITY.md

📜 Review details

🔇 Additional comments (1)

SECURITY.md (1)

1-25: LGTM!

Also applies to: 43-68

[coderabbitai]

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Replace the placeholder with a monitored security address.

The email fallback tells researchers to contact maintainers privately, but it provides no address or private channel. The HTML comments are not visible to readers. Add the project's official, monitored security contact before merge.