Create SECURITY.md for security policy and vulnerability reporting

[lafrej8962-design]

Added a security policy document outlining supported versions and vulnerability reporting.

[lafrej8962-design]

Ascode 🙃

[greptile-apps]

Greptile Summary

This PR introduces a SECURITY.md file to establish a security policy for the repository, but the file is an unmodified copy of GitHub's default template and is not ready to publish.

• The "Supported Versions" table lists versions 5.1.x, 5.0.x, and 4.0.x, none of which exist — the project is currently at 1.11.8. The table also retains the template's instructional preamble text.
• The "Reporting a Vulnerability" section contains only the boilerplate prompt text from the template, with no email address, GitHub Security Advisory link, response timeline, or disclosure process of any kind.

Confidence Score: 3/5

The file should not be merged in its current state — it contains no real information and would actively mislead security researchers about which versions are supported and how to report issues.

Both the version table and the vulnerability reporting section are unmodified GitHub template placeholders. The version numbers listed (5.x, 4.x) do not correspond to any real release of this project, and the reporting section gives no contact method, response timeline, or disclosure process whatsoever. Merging this as-is publishes a security policy that cannot be acted upon.

SECURITY.md needs the version table replaced with actual project release lines and the reporting section filled in with real contact details and process before this is ready.

Important Files Changed

Filename	Overview
SECURITY.md	New security policy file added using unmodified GitHub template — version table lists non-existent versions (5.x.x vs actual 1.11.8), and the vulnerability reporting section contains only placeholder text with no real contact information or process.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Security Researcher Finds Vulnerability] --> B{Consult SECURITY.md}
    B --> C[Check Supported Versions table]
    C --> D{Version listed?}
    D -- "No — table shows 5.x/4.x,\nproject is at 1.x" --> E[❌ Cannot determine if version is supported]
    D -- Yes --> F[Follow Reporting Instructions]
    F --> G{Instructions provided?}
    G -- "No — section is\nplaceholder text only" --> H[❌ No contact info, no process, no response SLA]
    G -- Yes --> I[✅ Submit vulnerability report]

Loading

_{Reviews (1): Last reviewed commit: "Create SECURITY.md for security policy" | Re-trigger Greptile}

[UnschooledGamer]

Seemed incomplete and spammy/unwanted PR.

[greptile-apps]

Version table reflects template placeholder, not actual project versions

The project's current version is 1.11.8 (as declared in package.json), but the table lists versions 5.1.x, 5.0.x, and 4.0.x — none of which exist in this repository. These are the unmodified placeholder values from GitHub's default SECURITY.md template. A security researcher reading this would have no idea which real releases receive patches.

[greptile-apps]

Reporting section is entirely placeholder text with no actionable instructions

The entire "Reporting a Vulnerability" section is unmodified from the GitHub template ("Use this section to tell people how to report a vulnerability…"). There is no email address, GitHub Security Advisories link, expected response time, or disclosure process. Anyone discovering a vulnerability would have nowhere to report it, defeating the purpose of the file.

[greptile-apps]

Section introduction is also placeholder template text

Lines 5–6 ("Use this section to tell people about which versions…") are GitHub template instructions intended to be replaced by the author, not published verbatim.