chore: add SECURITY.md with vulnerability reporting guidelines and supported versions

[germa89]

Description

Add security file with policies and supported versions to the repo.

Issue linked

Close #4054

Checklist

• I have visited and read Develop PyMAPDL.
• I have tested my changes locally
• I have added necessary documentation or updated existing documentation.
• I have followed the PyMAPDL coding style guidelines.
• I have added appropriate unit tests that also ensure the minimal coverage criteria.
• I have reviewed my changes before submitting this pull request.
• I have linked the issue or issues that are solved to the PR if any.
• I have assigned this PR to myself.
• I have marked this PR as draft if it is not ready to be reviewed yet.
• I have made sure that the title of my PR follows Commit naming conventions (e.g. feat: adding new MAPDL command)

Summary by Sourcery

Add SECURITY.md to define the project's security policy, including supported versions and instructions for reporting vulnerabilities.

Documentation:

• Add a SECURITY.md file outlining supported project versions and compatibility.
• Document the proper process and required details for securely reporting vulnerabilities.

[ansys-reviewer-bot]

Thanks for opening a Pull Request. If you want to perform a review write a comment saying:

@ansys-reviewer-bot review

[sourcery-ai]

Reviewer's Guide

This PR adds a new SECURITY.md file outlining vulnerability reporting guidelines, supported versions, and license information.

File-Level Changes

Change	Details	Files
Introduce security guidelines document	Add MIT license header Define supported versions table Detail vulnerability reporting process and required information Link to MAPDL compatibility documentation	SECURITY.md

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#4054	Add a SECURITY.md file to the repository.	✅
#4054	Ensure the SECURITY.md file is up-to-date with the expected format.	✅

Possibly linked issues

• [MAINTENANCE] Missing or outdated SECURITY.md file in ansys/pymapdl #4054: The PR adds the SECURITY.md file as requested by the issue.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey @germa89 - I've reviewed your changes - here's some feedback:

• Consider removing the MIT license header from SECURITY.md to avoid duplicating the repo license and keep the security policy focused.
• Add an expected timeline for vulnerability triage and resolution (e.g. initial response within X days) to set clear expectations for reporters.
• Replace GitHub emoji syntax in the version support table with plain Unicode checkmarks and crosses to ensure consistent rendering across Markdown viewers.

Prompt for AI Agents

Please address the comments from this code review:
## Overall Comments
- Consider removing the MIT license header from SECURITY.md to avoid duplicating the repo license and keep the security policy focused.
- Add an expected timeline for vulnerability triage and resolution (e.g. initial response within X days) to set clear expectations for reporters.
- Replace GitHub emoji syntax in the version support table with plain Unicode checkmarks and crosses to ensure consistent rendering across Markdown viewers.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[germa89]

Following #4054 and blatantly copying the security file from PyAnsys Geometry - Security file; I have set the supported versions to the last 3.

But thinking about it, I dont think it makes much sense, like... we are in 0.70.2 in PyMAPDL. If a bug is fixed, it is published in 0.70.3. We do not keep branches with 0.69.X or 0.68.X. Hence, the list of supported versions is only 0.70.3. Am I right?

Pinging @ansys/pyansys-core for review and feedback on the comment above.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 89.14%. Comparing base (ed77001) to head (1a20232).
Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4059      +/-   ##
==========================================
- Coverage   89.18%   89.14%   -0.05%     
==========================================
  Files         187      187              
  Lines       14993    14993              
==========================================
- Hits        13372    13365       -7     
- Misses       1621     1628       +7     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[RobPasMue]

But thinking about it, I dont think it makes much sense, like... we are in 0.70.2 in PyMAPDL. If a bug is fixed, it is published in 0.70.3. We do not keep branches with 0.69.X or 0.68.X. Hence, the list of supported versions is only 0.70.3. Am I right?

Well - I think it is a good practice to support users that might be stuck with older versions in terms of security issues. Imagine you find a bad security vulnerability (not a normal patch, or feature). You should support a few minor releases in that sense I believe. But at the end of the day, it's the maintainers decision =)

[germa89]

In theory, we could do that. In practice we dont. But yeah, nothing is preventing us to cherry pick bugs to older branches.

Ok. Great. Thank you for your feedback @RobPasMue

[germa89]

@pyansys-ci-bot LGTM.

[pyansys-ci-bot]

✅ Approving this PR because germa89 said so in here 😬