docs: add SECURITY.md (GitHub security policy)

[AojdevStudio]

Sets up the repo's security policy at .github/SECURITY.md — the file behind GitHub's Security → Security policy "Start setup" prompt.

What this adds

A vulnerability-disclosure policy grounded in this repo's real authority surface, not a generic template:

• Reporting: GitHub Private Vulnerability Reporting as the primary channel (with a caveat if it isn't enabled), admin@unifiedental.com as fallback, and an explicit "do not open public issues" rule.
• Supported versions: honest pre-1.0 story — fixes land on main / the latest tagged line (v0.2.0, source-only) only; no backports; forks pull fixes forward themselves.
• Response/disclosure: best-effort, non-SLA framing sized for a single, AI-assisted maintainer; coordinated disclosure via GitHub Security Advisories.
• Scope: in/out-of-scope tied to the actual authority boundary — license sign/verify (crates/license-sign, crates/license-verify), server-side entitlements (services/api/src/entitlement.rs), Stripe webhook HMAC + idempotency (services/api/src/webhook.rs), secret/key leakage into the desktop, and the cargo xtask gate checks (xtask/src/{edges,leakscan,coverage,seam_scan}.rs) that enforce them.
• Safe harbor: limited good-faith-research authorization; AS-IS, no warranty.
• "If you build a product on this kit": forks — especially healthcare/finance — own their own HIPAA/PCI posture, durable audit storage, and SECURITY.md.

Notes

• Branched off origin/main (d436da6), so this PR is independent of the pending local CHANGELOG commit.
• Every cited file/crate/symbol path was verified to exist in the tree.
• Follow-ups (not done in this PR): (1) enable repo Private Vulnerability Reporting so the primary channel's button appears; (2) the admin@unifiedental.com fallback is easily changed — flag if you'd prefer a different address or PVR-only.

[greptile-apps]

Greptile Summary

This PR adds .github/SECURITY.md — the GitHub-recognised security policy file — to the repository. The policy is well-tailored to the project's actual authority surface rather than a copy-paste template.

• Reporting channels: primary GitHub PVR flow with step-by-step instructions, a plaintext-safe email fallback (admin@unifiedental.com), and an explicit "no public issues" rule.
• Supported versions: accurately reflects the current pre-1.0, no-tags state (main / commit SHA only, workspace 0.1.0), with honest single-maintainer SLA caveats.
• Scope, safe harbor, and fork guidance: in-scope items are tied to real files that exist in the tree; the "If you build a product on this kit" section clearly places compliance responsibility on downstream forks.

Confidence Score: 5/5

Documentation-only change with no executable code; safe to merge.

The change adds a single Markdown file. All cited file paths (services/api/src/webhook.rs, crates/license-sign/, xtask/src/edges.rs, etc.) were verified to exist in the tree. The workspace version (0.1.0) and the 'no release tags yet' statement both match the current repo state. No logic, security boundary, or runtime behaviour is affected.

No files require special attention.

Important Files Changed

Filename	Overview
.github/SECURITY.md	New security policy document; version strings, cited file paths, and tag status all verified against the repo's current state.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Security Reporter] -->|finds vulnerability| B{Channel selection}
    B -->|PVR enabled| C[GitHub Security tab → Advisories → Report a vulnerability]
    B -->|PVR unavailable| D[Email: admin@unifiedental.com]
    C --> E[Private Advisory visible to reporter + maintainer only]
    D --> E
    E --> F[Maintainer acknowledges best-effort]
    F --> G[Initial assessment + severity triage]
    G --> H{In scope?}
    H -->|Yes – authority boundary break| I[Agree on disclosure timeline]
    H -->|No – OOS or theoretical| J[Closed / redirected upstream]
    I --> K[Fix lands on main]
    K --> L[GitHub Security Advisory published]
    L --> M[Reporter credited]

Loading

_{Reviews (2): Last reviewed commit: "fix(review): address Greptile feedback +..." | Re-trigger Greptile}