docs: add SECURITY.md (vulnerability + safety disclosure policy)

[kambleakash0]

User description

What

Adds a root SECURITY.md for the now-public repo.

Covers two report types, both privately via GitHub private vulnerability reporting (enabled on the repo — Report a vulnerability):

• ordinary code/dependency vulnerabilities (model gateway, eval harness, deps);
• safety-posture issues specific to this project — raw harmful content that slipped into the repo/history, a leaked secret, or a pull path to the private degraded/DPO/attribution adapters.

Asks reporters to describe the class of problem privately rather than post exploits or harmful content publicly, and ties to RESPONSIBLE_USE.md. Out-of-scope: the study's disclosed judge-proxy limitations, and the base model/public datasets' own behavior.

Closes #205

---

PR Type

Documentation

---

Description

• Add private vulnerability and safety-disclosure reporting policy.

• Define supported branch and security reporting scope.

• Establish disclosure safeguards and best-effort response expectations.

• Link defensive guidance to RESPONSIBLE_USE.md.

---

File Walkthrough

Relevant files

Documentation

SECURITY.md Document private security reporting and responsible disclosure SECURITY.md Add a root security policy covering current main, with defensive framing and a link to RESPONSIBLE_USE.md. Direct software vulnerabilities and repository-specific safety issues to GitHub private reporting; specify report details and best-effort acknowledgment expectations. Define in-scope harmful content, leaked credentials, and private adapter exposure; exclude documented study limitations and upstream model/dataset behavior. Require coordinated disclosure, prohibit public exploits and unauthorized access or redistribution, and welcome good-faith research with a conditional non-action commitment. +56/-0

---

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 205 - Partially compliant Compliant requirements: Add a root SECURITY.md. Direct ordinary code and dependency vulnerability reports to GitHub private vulnerability reporting rather than public issues. Cover private reporting of raw harmful content, leaked secrets, and access paths to private adapters. Tell reporters not to publish sensitive details or exploits in public issues. Link to RESPONSIBLE_USE.md and preserve the project's defensive framing. Non-compliant requirements: None.

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected