Add `SECURITY.md` with vulnerability disclosure policy

[nanaf6203-bit]

Problem Statement

No SECURITY.md is present in the repo root (verified by glob).

Why it matters

Standard CNCF/SF policy: every public crate needs a security disclosure path & SLA.

Technical Context

• Compile an email/GPG/HackerOne disclosure policy.
• Document supported / unsupported versions.
• CVSS handling and timeline commitments.
• Audit-trail disclosure doc pattern.

Expected Outcome

Repo SECURITY.md is discoverable from GitHub UI.

Acceptance Criteria

1. SECURITY.md at repo root.
2. Lists disclosure channel + 90-day minimum deadline.
3. Includes a Supported Versions table.
4. Linked from README.md.
5. CI fails PRs that delete or weaken the policy.

Implementation Notes

Single file write + README link.

Files or modules likely to be affected

SECURITY.md, README.md.

Dependencies

None.

Difficulty level

EASY.

Estimated effort

S (~half a day).

[Ibinola]

@Ibinola has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Hello, I'd like to pick this issue up.

I'm a software engineer with strong experience in JavaScript and building scalable web applications. I'm comfortable working across the stack, writing clean, maintainable code, and collaborating in open source environments.

I understand what's being asked here and I'm confident I can implement this correctly and efficiently.

Please assign this issue to me, I'd be happy to contribute.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Ibinola to this issue.

[drips-wave]

Congratulations, @Ibinola! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @Ibinola: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[drips-wave]

This issue has been completed by @Ibinola as part of the Stellar Wave Program's 7th Wave 🥳

😎 @Ibinola: You earned 200 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.