The canonical security policy lives in docs/SECURITY.md.

GitHub recognizes SECURITY.md at the repository root, so this file stays here as a pointer while the actual policy lives under docs/.