[I-01] No security-txt / vulnerability-disclosure policy published

[simonjcarr]

Severity: Info / Hardening
Finding ID: I-01
Source: SECURITY.md

Description:
No security-txt / vulnerability-disclosure policy published.

Fix direction:
Publish /.well-known/security.txt with contact, encryption, policy URL. Add a SECURITY_DISCLOSURE.md at the repo root.

---

This issue tracks a finding from the pre-pentest internal code audit.