chore: add a security policy and reporting

[mbevc1]

Updated the security policy to reflect supported versions and reporting procedures.

Checklist

• Helm chart (charts/k8s-reporter/) updated, if needed. Note: these changes live in a separate PR
• Terraform provider and related changes (terraform-provider-kosli, terraform-aws-evidence-reporter, terraform-aws-kosli-reporter) updated, if needed
• Docs are autogenerated from CLI help — make sure the help text reflects your changes

[claude]

Claude finished @mbevc1's task in 40s —— View job

---

PR Review: chore: add a security policy and reporting

Thanks for adding a security policy, @mbevc1 — having a clear, discoverable disclosure path is a real improvement for the repo. This is a documentation-only change (one new SECURITY.md), so the Go static-analysis checks (go build / go vet / go mod tidy) don't apply here.

The content is clear, well-structured, and the requested wording from your own review comment is already reflected in the file. A few small, non-blocking suggestions:

Suggestions

1. Consider GitHub's private vulnerability reporting (line 7–9). Email is a fine primary channel, but GitHub's built-in private vulnerability reporting is more discoverable — it surfaces a "Report a vulnerability" button directly on the repo's Security tab. If it's enabled for this repo, worth mentioning it alongside security@kosli.com so reporters have a clear in-platform option.

2. Tone on line 5 (minor/optional). The exclamation mark reads a little informal for a policy doc:

   Only v2 of the Kosli CLI is currently supported! Please try and use the latest release before reporting an issue.

   A period instead of ! would keep it matching the measured tone of the rest of the document. Purely stylistic — take it or leave it.

3. "Supported Versions" format (optional). GitHub's default SECURITY.md template uses a small table for supported versions. The prose here is perfectly clear, so this is only worth it if you expect to track multiple concurrently-supported majors later.

Nothing blocking

No security, correctness, or maintainability concerns — it's a Markdown policy file with no executable impact. The reporting instructions are specific and actionable (description, repro, impact, evidence), and the "Our Commitment" section sets good expectations for researchers. Nice work. 👍
· mbevc1-patch-1