docs: add SECURITY.md — vulnerability disclosure policy

SECURITY.md

@@ -0,0 +1,39 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| latest (mainnet) | ✅ |
+| older releases | ❌ |
+
+## Reporting a Vulnerability
+
+**Do NOT open a public issue for security vulnerabilities.**
+
+Please report security vulnerabilities by emailing:
+
+📧 **security@pezkuwichain.io**
+
+Include:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (optional)
+
+We will acknowledge receipt within **48 hours** and provide a detailed response within **7 days**.
+
+## Disclosure Policy
+
+We follow [coordinated disclosure](https://en.wikipedia.org/wiki/Coordinated_vulnerability_disclosure).
+Once a fix is ready, we will:
+
+1. Notify the reporter
+2. Release a patched version
+3. Publish a security advisory
+
+## Bug Bounty
+
+There is currently no formal bug bounty program.
+Significant vulnerability reporters will be acknowledged in release notes.
+