Create SECURITY.md for security policy

[lisagorewitdecker]

Added a security policy document outlining supported versions and vulnerability reporting.

[Copilot]

Pull request overview

Adds a SECURITY.md document intended to define the project’s supported versions and the process for reporting security vulnerabilities.

Changes:

• Introduces SECURITY.md with sections for supported versions and vulnerability reporting guidance.

Suppressed comments (1)

SECURITY.md:21

• The Reporting a Vulnerability section is placeholder template text. SECURITY.md should specify a concrete private reporting channel (e.g., GitHub private vulnerability reporting) and set expectations for response/triage so reporters know what to do.

Use this section to tell people how to report a vulnerability.

Tell them where to go, how often they can expect to get an update on a
reported vulnerability, what to expect if the vulnerability is accepted or
declined, etc.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[lisagorewitdecker]

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.

[Copilot]

@copilot Fix the code for all comments in this review thread.

When a review comment includes a sugge...

Fixed in the latest commit. The placeholder "Reporting a Vulnerability" text has been replaced with actual guidance (how to report, expected response time, and what to expect for accepted/declined vulnerabilities). The Supported Versions table already used project-appropriate versioning ("latest" / "< latest") rather than the example 5.x/4.x values.