Create SECURITY.md for security policy

[lisagorewitdecker]

Added a security policy document outlining supported versions and vulnerability reporting.

[Copilot]

🟡 Changes recommended

The added SECURITY.md is still the default template (placeholder text and example versions) and needs to be replaced with repo-specific support and reporting details.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a repository-level SECURITY.md intended to document the project’s security support policy and vulnerability reporting process.

Changes:

• Introduces a new SECURITY.md document.
• Includes sections for supported versions and vulnerability reporting (currently template placeholders).

File summaries

File	Description
SECURITY.md	Adds a security policy document scaffold for supported versions and vulnerability reporting.

Review details

Suppressed comments (2)

SECURITY.md:13

• The version support table lists example versions (5.1.x/5.0.x/4.0.x/<4.0) that are likely unrelated to this project and could mislead users. Update the table to match real released versions/tags for this repository, or remove it in favor of a clear policy statement.

| ------- | ------------------ |
| 5.1.x   | :white_check_mark: |
| 5.0.x   | :x:                |
| 4.0.x   | :white_check_mark: |
| < 4.0   | :x:                |

SECURITY.md:21

• The “Reporting a Vulnerability” section is still the default template and doesn’t tell reporters where to send details. Provide a real intake channel (e.g., GitHub Security Advisories / ‘Report a vulnerability’ in the Security tab, or a security contact email) and set expectations for acknowledgment and updates.

Use this section to tell people how to report a vulnerability.

Tell them where to go, how often they can expect to get an update on a
reported vulnerability, what to expect if the vulnerability is accepted or
declined, etc.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.