docs: Create SECURITY.md with responsible disclosure policy

[Xhristin3]

Problem Statement

No security policy or responsible disclosure process exists. Security researchers have no documented way to report vulnerabilities.

Evidence

SECURITY.md does not exist.

Impact

Vulnerabilities may be disclosed publicly instead of privately. No defined response SLA. Potential security issues may go unreported.

Proposed Solution

Create SECURITY.md with:

1. Supported versions
2. How to report a vulnerability (private channel)
3. Expected response time (48h acknowledgment, 7d resolution for critical)
4. Disclosure policy (coordinated disclosure after fix)

Acceptance Criteria

• SECURITY.md exists
• Includes reporting instructions
• Includes supported version policy
• Includes response SLA

File Map

• SECURITY.md — new

---

Labels: documentation, security, good first issue
Priority: Medium | Difficulty: Beginner | Estimated Effort: 0.5h

---

Labels: documentation,security,good first issue
Priority: Medium | Difficulty: Beginner | Estimated Effort: 0.5h
Backlog ID: REPO-029

[Faithy5]

I would love to work on this project as I have experience on it. Please assign this work to me.

[shadrach68]

Hi maintainer, I am confident that I can resolve this issue before 24hrs if assigned to me because I have the technical expertise to resolve it.

[grantfox-oss]

🦊 GrantFox — @Faithy5 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #212)
2. Your PR will be reviewed by the XStreamRollz maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign campaign!

@Faithy5's PR #270 was approved and merged by @Xhristin3.

🏆 @Faithy5: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (48 total points). Track your full progress on GrantFox.

👏 Great work, @Faithy5! Keep contributing to XStreamRollz.