docs: make default security policy repository-neutral

CONTRIBUTING.md

@@ -187,6 +187,6 @@ See [RELEASING.md](RELEASING.md) for the full operational doc (promotion criteri
 
 - Create an [issue](https://github.com/PicPeak/picpeak/issues) for bugs or features
 - Join [discussions](https://github.com/PicPeak/picpeak/discussions) for questions
-- Security issues: Open a [security issue](https://github.com/PicPeak/picpeak/issues/new?labels=security) on GitHub
+- Security vulnerabilities: Follow the [security policy](SECURITY.md) to report privately in the affected repository or by email
 
-Thank you for contributing! 🎉
+Thank you for contributing! 🎉

SECURITY.md

@@ -1,88 +1,52 @@
 # Security Policy
 
-## Supported Versions
+## Scope and Supported Versions
 
-We release patches for security vulnerabilities. Currently supported versions:
+This is the default security policy for repositories in the PicPeak organization.
+A repository's own `SECURITY.md` takes precedence and defines any project-specific
+supported versions and release channels.
 
-| Version | Supported          |
-| ------- | ------------------ |
-| 2.x.x   | :white_check_mark: |
-| < 2.0   | :x:                |
+For the PicPeak application, see its
+[security policy](https://github.com/PicPeak/picpeak/blob/main/SECURITY.md)
+for support and security releases on `stable` and `main`.
 
-## Reporting a Vulnerability
-
-We take the security of PicPeak seriously. If you have discovered a security vulnerability, please follow these steps:
-
-### 1. **Do NOT create a public GitHub issue**
-
-### 2. Report the vulnerability privately by:
-- **Preferred:** Use [GitHub Private Vulnerability Reporting](https://github.com/PicPeak/picpeak/security/advisories/new)
-- **Alternative:** Email us at **info@picpeak.app** with the details
-- Include:
-  - Description of the vulnerability
-  - Steps to reproduce
-  - Potential impact
-  - Suggested fix (if any)
-
-### 3. You can expect:
-- Acknowledgment within 48 hours
-- Regular updates on our progress
-- Credit in the fix announcement (unless you prefer to remain anonymous)
-
-## Security Measures
+Other projects have independent versioning. Follow the supported releases stated
+in the affected repository. For projects without versioned releases, use the
+current default branch and deploy its latest fixes. PicPeak application version
+numbers do not define support for the usage collector, documentation or other
+repositories.
 
-PicPeak implements several security measures:
+Security fixes are delivered through all supported release channels of the
+affected project. Superseded releases are not maintained separately unless the
+repository explicitly documents otherwise.
 
-### Authentication & Authorization
-- JWT-based authentication with secure token storage
-- bcrypt password hashing with configurable rounds
-- Role-based access control for admin functions
-- Session timeout management
-
-### Input Validation
-- All user inputs are validated and sanitized
-- SQL injection prevention through parameterized queries
-- XSS protection via Content Security Policy
-- File upload restrictions and validation
-
-### Rate Limiting
-- API rate limiting to prevent abuse
-- Brute force protection on authentication endpoints
-- Configurable limits per endpoint
-
-### Data Protection
-- HTTPS enforcement in production
-- Secure cookie settings
-- CORS configuration
-- Sensitive data encryption
-
-### Infrastructure
-- Regular dependency updates
-- Security headers (HSTS, X-Frame-Options, etc.)
-- Activity logging for audit trails
-- Automated backups
+## Reporting a Vulnerability
 
-## Best Practices for Deployment
+**Do not report vulnerabilities in public issues, discussions or pull requests.**
 
-1. **Always use HTTPS** in production
-2. **Change default passwords** immediately
-3. **Keep dependencies updated** regularly
-4. **Configure firewall rules** appropriately
-5. **Monitor logs** for suspicious activity
-6. **Backup regularly** and test restoration
+- Use **Report a vulnerability** under the affected repository's **Security** tab
+  when private vulnerability reporting is available.
+- If the repository does not offer private reporting, or you cannot use GitHub,
+  email **info@picpeak.app**.
+- For the PicPeak application, the
+  [private reporting form](https://github.com/PicPeak/picpeak/security/advisories/new)
+  is available directly.
 
-## Vulnerability Disclosure
+Include the repository and component, affected version or commit, deployment
+method, reproduction steps, expected impact and any suggested fix. Remove
+credentials and personal data from logs and examples.
 
-We believe in responsible disclosure. Once a vulnerability is fixed:
+## Response and Disclosure
 
-1. We'll publish a security advisory
-2. Credit researchers (with permission)
-3. Detail the impact and mitigation steps
-4. Release patches for all supported versions
+We aim to acknowledge reports within 48 hours. This is a response target, not a
+guaranteed service level or a promised resolution time. We will provide progress
+updates and coordinate disclosure with the reporter.
 
-## Contact
+Security advisories and release notes identify affected versions or commits,
+available fixes and any required mitigation or upgrade steps. Reporter credit is
+optional and included with permission.
 
-- Security issues: Email **info@picpeak.app** or use [GitHub Private Vulnerability Reporting](https://github.com/PicPeak/picpeak/security/advisories/new)
-- General support: [GitHub Issues](https://github.com/PicPeak/picpeak/issues)
+## Deployment and General Support
 
-Thank you for helping keep PicPeak and its users safe!
+Use the affected project's deployment documentation for security configuration,
+updates and backups. Follow its support guide for ordinary bugs and questions.