docs: 🔒 add security vulnerability reporting policy

Author: faresrafat3

SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Supported Versions
+We actively maintain and provide security updates for the current major versions of this repository.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| v1.0.x  | :white_check_mark: |
+| < v1.0  | :x:                |
+
+## Reporting a Vulnerability
+Security is a top priority for this architecture. If you discover a security vulnerability (e.g., prompt injection flaws, unauthorized code execution paths, or API key leaks), please DO NOT open a public issue.
+
+Instead, report it privately to the lead maintainer:
+**Email:** faresrafat3@gmail.com
+
+**What to include:**
+- A detailed description of the vulnerability.
+- Steps to reproduce the issue.
+- Potential impact and, if possible, a suggested mitigation.
+
+We will acknowledge receipt of your vulnerability report within 48 hours and strive to send you regular updates about our progress. If you report a valid vulnerability, we will work with you to remediate it and provide appropriate credit in our security advisories.