Create SECURITY.md for security policy

[lisagorewitdecker]

Added a security policy document outlining supported versions and vulnerability reporting.

[Copilot]

Pull request overview

Adds a repository-level SECURITY.md to document the project’s security policy, including which versions receive security fixes and how to report vulnerabilities.

Changes:

• Introduced SECURITY.md with sections for supported versions and vulnerability reporting.
• Added a supported-versions table (currently template/example content).
• Added vulnerability reporting guidance (currently template content).

Suppressed comments (2)

SECURITY.md:13

• The supported versions table lists example versions (5.1.x/5.0.x/4.0.x) that don't match this project's current versioning (package.json is 0.0.4). This should be updated to reflect what is actually supported so the policy is not misleading.

| Version | Supported          |
| ------- | ------------------ |
| 5.1.x   | :white_check_mark: |
| 5.0.x   | :x:                |
| 4.0.x   | :white_check_mark: |
| < 4.0   | :x:                |

SECURITY.md:21

• This reporting section is still the default template text and doesn't provide an actual reporting channel. It should include a concrete place to report vulnerabilities (preferably private) and guidance not to open public issues.

Use this section to tell people how to report a vulnerability.

Tell them where to go, how often they can expect to get an update on a
reported vulnerability, what to expect if the vulnerability is accepted or
declined, etc.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[lisagorewitdecker]

@copilot Fix the code for all comments in this review thread.

When a review comment includes a suggested change, apply the suggestion exactly.

Do not make changes beyond what is described in the linked review thread.