Added vulnerability reporting process SECURITY.md (#279)

## Checklist
<!-- Put an `x` in the boxes. All tasks must be completed and boxes
checked before merging. -->

- [x] 🤖 This change is covered by unit tests as required.
- [x] 🤹 All required manual testing has been performed.
- [x] 🛡️ Security impacts have been considered.
- [x] 📖 All documentation updates are complete.
- [x] 🧠 This change does not change third-party dependencies

Author: soumeh01

SECURITY.md

@@ -0,0 +1,34 @@
+# Open-CMSIS-Pack Security Policy  
+
+This document outlines the security procedures and policies for the Open-CMSIS-Pack cmsis-toolbox project.  
+
+## Table of Contents  
+- [Reporting a Security Issue](#reporting-a-security-issue)  
+- [Vulnerability Management](#vulnerability-management)  
+- [Improving This Policy](#improving-this-policy)  
+
+## Reporting a Security Issue  
+
+The Open-CMSIS-Pack cmsis-toolbox maintainers take security issues seriously and appreciate responsible disclosure. Your efforts to improve project security are highly valued.  
+
+We use GitHub's [private vulnerability reporting](https://docs.github.com/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-vulnerabilities/privately-reporting-a-security-vulnerability). To submit a report, please include:  
+
+- A detailed description of the issue  
+- Steps to reproduce the vulnerability  
+- Affected project versions  
+- Any known mitigations  
+
+A maintainer will acknowledge your report as soon as possible and guide the next steps. We will keep you informed of progress toward a fix and may request additional details if needed.  
+
+## Vulnerability Management  
+
+Once a security issue is reported, the maintainers will:  
+
+1. Confirm the issue  
+2. Identify/Confirm affected versions  
+3. Audit related code for similar vulnerabilities  
+4. Develop and release patches for maintained versions  
+
+## Improving This Policy  
+
+If you have suggestions for improving this process, please open an issue or submit a pull request.