docs: publish security reporting policy

.github/ISSUE_TEMPLATE/bug_report.md

@@ -6,6 +6,9 @@ labels: bug
 assignees: ""
 ---
 
+> For suspected security vulnerabilities, do not use this public template.
+> Please follow the [security policy](../../SECURITY.md) and report privately.
+
 ## Description
 
 <!-- What happened, and what did you expect to happen instead? -->

README.md

@@ -119,6 +119,12 @@ Issues on the Wave tracker use the following complexity labels with correspondin
 See the org-wide
 [CONTRIBUTING.md](https://github.com/stellar-vortex-protocol/.github/blob/main/CONTRIBUTING.md).
 
+## Security
+
+Please read the [security policy](./SECURITY.md) before reporting a potential
+vulnerability. Use GitHub's private vulnerability reporting flow rather than a
+public issue for security-sensitive details.
+
 ## License
 
 [MIT](./LICENSE) © 2025 Vortex Protocol Contributors

SECURITY.md

@@ -0,0 +1,43 @@
+# Security policy
+
+## Supported versions
+
+This repository is under active development. Security fixes are evaluated
+against the `main` branch and the latest published release, when a release is
+available. Older commits and unreleased feature branches may not receive a
+backport.
+
+## Reporting a vulnerability
+
+Please report suspected vulnerabilities privately through GitHub's **Report a
+vulnerability** flow on this repository's Security tab. Include only the
+minimum information needed to reproduce the issue and avoid real user data,
+private keys, or production credentials.
+
+If private vulnerability reporting is not enabled, contact a repository
+maintainer through their GitHub profile and request a private channel. Do not
+include exploit details in a public issue, pull request, or discussion.
+
+Please include:
+
+- the affected commit, release, or route;
+- concise reproduction steps and expected versus observed behaviour;
+- the security impact and any prerequisites; and
+- a minimal proof of concept that uses only local or test data.
+
+We will acknowledge a report when a maintainer is available, work with the
+reporter to reproduce it, and share remediation or disclosure timing when the
+scope and impact are understood. This is a contributor-run project, so exact
+response and fix timelines cannot be guaranteed.
+
+## Safe harbor
+
+Good-faith research is welcome when it avoids privacy violations, service
+degradation, or disruption of other users. Do not access data that is not
+yours, submit transactions with real value, use stolen credentials, probe
+production systems, perform denial-of-service testing, or contact users.
+
+Please stop testing and report privately as soon as you confirm a potential
+issue. We will not pursue legal action for research that follows this policy,
+stays within the repository's own code and test environments, and avoids
+accessing or modifying other people's data.