Create SECURITY.md

[ofek1weiss]

Summary by CodeRabbit

• Documentation
  • Added a security policy with clear guidance on how to report vulnerabilities privately.
  • Outlined expected response timing, supported version handling, and the disclosure process after a confirmed issue.
  • Clarified the scope of reporting and where to direct product-related security concerns.

[linear]

APP-1378

[github-actions]

👋 @ofek1weiss
Thank you for raising your pull request.
Please make sure to add tests and document all user-facing changes.
You can do this by editing the docs files in the elementary repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7a1760a7-d005-4d8b-91f9-2161dcaf7b7b

📥 Commits

Reviewing files that changed from the base of the PR and between 231dbfd and 8154fe5.

📒 Files selected for processing (1)

• SECURITY.md

---

📝 Walkthrough

Walkthrough

This pull request adds a new SECURITY.md file establishing a security policy, covering private vulnerability reporting via GitHub Security Advisories, a 10-business-day acknowledgement timeline, supported-version scope, and the post-confirmation disclosure workflow.

Changes

Security Policy Documentation

Layer / File(s)	Summary
Add security policy document SECURITY.md	Adds reporting instructions, acknowledgement timeline, supported-version guidance, scope limitations, and disclosure workflow.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Related PRs: None identified from the provided context.

Suggested labels: documentation

Suggested reviewers: None identified from the provided context.

---

🐰 A rabbit hops to guard the code,
With SECURITY.md now bestowed,
Report in private, not in the square,
We'll patch it fast with utmost care,
A gentle hop, a safer road.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: adding a SECURITY.md file.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch app-1378-add-securitymd-file

---

_{Comment @coderabbitai help to get the list of available commands.}