security: Add SECURITY.md with vulnerability reporting guidelines

Establishes:
- Clear vulnerability reporting process
- Expected response times
- Security best practices for contributors
- Overview of automated security features

Author: firascoding

SECURITY.md

@@ -0,0 +1,79 @@
+# Security Policy
+
+## 🔒 Reporting Security Vulnerabilities
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+If you discover a security vulnerability, please report it privately:
+
+**Email:** [your-security-email@example.com]
+
+You should receive a response within 48 hours. If not, please follow up to ensure we received your report.
+
+---
+
+## 📋 What to Include in Your Report
+
+Please provide:
+
+1. **Description** of the vulnerability
+2. **Steps to reproduce** the issue
+3. **Potential impact** of the vulnerability
+4. **Affected versions** (if applicable)
+5. **Suggested fix** (if you have one)
+6. **Any supporting materials** (proof-of-concept, screenshots, etc.)
+
+---
+
+## 🛡️ Our Security Process
+
+### 1. Acknowledgment
+We'll acknowledge your report within 48 hours.
+
+### 2. Investigation
+We'll investigate and validate the issue within 7 days.
+
+### 3. Fix Development
+We'll develop and test a fix.
+
+### 4. Disclosure
+We'll coordinate disclosure timing with you.
+
+### 5. Release
+We'll release the security update.
+
+### 6. Credit
+We'll acknowledge your contribution (unless you prefer anonymity).
+
+---
+
+## ✅ Security Best Practices
+
+When contributing to this repository:
+
+- ❌ Never commit credentials, API keys, or secrets
+- ✅ Use environment variables for sensitive configuration
+- ✅ Keep dependencies up to date
+- ✅ Run security tests before submitting pull requests
+- ✅ Review the `.gitignore` to ensure sensitive files are excluded
+
+---
+
+## 🤖 Automated Security
+
+This repository uses:
+
+- **Dependabot** - Automated dependency vulnerability alerts and updates
+- **GitHub Code Scanning** - Automated security analysis
+- **Secret Scanning** - Prevents credential leaks
+- **Branch Protection** - Prevents direct commits to main
+
+---
+
+## 📞 Questions?
+
+If you have questions about this security policy, please open a discussion or contact the maintainers.
+
+---
+
+**Last Updated:** November 2025