Repository lacked formal security policy following @blankshiro's vulnerability report in #294.

Changes

• SECURITY.md: Establishes vulnerability reporting workflow

  • Private disclosure via GitHub Security Advisories (preferred)
  • Alternative MITRE CVE submission if GitHub advisory system inaccessible
  • Response SLAs and disclosure process
  • Troubleshooting steps for antivirus-blocked advisory access
  • Hall of Fame crediting security researchers

• README.md: Links to security policy from main page

• Attribution: Generated by GitHub Copilot

Security Reporting Flow

Reporter → GitHub Security Advisory (private)
       → Maintainer review → Fix → Publish → Auto CVE
       
Fallback: Direct MITRE submission if GitHub blocked

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.