docs: add SECURITY.md with vulnerability disclosure policy

[yachikadev]

Closes #620

What's changed

• Added SECURITY.md in the root of the repository

Why

DevCard handles user contact data and profile information but had no security disclosure policy. This is a GitHub best practice for any public repo handling personal data.

What's included

• Supported versions table
• Reporting channel via GitHub Private Security Advisory (keeps disclosure private by default)
• Response timeline (48hr acknowledgement, 7 day update, 30 day fix)
• In-scope vulnerabilities specific to DevCard's attack surface
• Out-of-scope items
• Responsible disclosure policy
• Acknowledgement policy for reporters

[vercel]

@yachikadev is attempting to deploy a commit to the Prashantkumar Khatri's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Hi @yachikadev,

Thanks for opening this pull request.

This PR has been automatically classified based on the files modified.

Applied Labels

• gssoc:approved

Primary Review Area

• null

Reviewer

null has been identified as the primary reviewer for this pull request.

If you have any questions regarding the affected area or implementation details, feel free to reach out to the assigned reviewer.

Thank you for your contribution!

[github-actions]

CI — All Checks Passed

Backend — SKIP

Check	Result
Lint	-
Test	-
Typecheck	-

Mobile — SKIP

Check	Result
Lint	-
Test	-

Web — SKIP

Check	Result
Build	-

---

Last updated: Wed, 01 Jul 2026 08:49:09 GMT

[ShantKhatri]

No major change in this table, so please remove the changes footprint from this table.

[ShantKhatri]

No major change in this table, so please remove the changes footprint from this table.

[yachikadev]

Thanks for the review @ShantKhatri! I've reverted both tables to their original format — removed the unnecessary formatting changes from the Supported Versions and Response Timeline sections. Please have a look!