docs: add coordinated vulnerability disclosure policy

[adithyan-ak]

Description

Adds SECURITY.md with a coordinated vulnerability-disclosure policy tailored to FluidVoice.
The policy gives researchers a non-public reporting route and defines the project boundaries most relevant to FluidVoice: microphone, Accessibility and Apple Events permissions, local API, Keychain-stored provider credentials, dictation/text insertion, analytics, optional cloud AI, and the update/release supply chain.

Type of Change

• 🐞 Bug fix
• ✨ New feature
• 💥 Breaking change
• 🧹 Chore
• 📝 Documentation update

Related Issue or Discussion

Closes #935

Testing

• Documentation-only review completed.
• Ran git diff --check successfully.
• Tested on Intel Mac — not applicable (documentation-only).
• Tested on Apple Silicon Mac — not applicable (documentation-only).
• Ran linter locally — not applicable (no Swift source change).
• Ran formatter locally — not applicable (no Swift source change).
• Ran tests locally — not applicable (no executable change).

Screenshots / Video

• No UI/visual changes; screenshots/video are not applicable.

Notes for Maintainers

The policy intentionally uses GitHub private vulnerability reporting / GHSA as the confidential intake path rather than an email address. The repository setting is currently disabled. A maintainer with repository-admin permission must enable Settings → Advanced Security → Private vulnerability reporting before the “Report a vulnerability” action described in SECURITY.md is available.
Please confirm:

1. GHSA-only private intake is the desired channel.
2. Supporting only the latest stable release and current main is appropriate.
3. The proposed targets—acknowledgement within 3 business days, triage within 7 business days, and updates every 14 days—are sustainable.
4. The good-faith-research language is acceptable for the project.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T20:39:30.148153Z	b962aed	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[greptile-apps]

Greptile Summary

Adds a coordinated vulnerability-disclosure policy for FluidVoice.

• Defines supported versions and the private GHSA reporting process.
• Documents security scope, good-faith research boundaries, response targets, disclosure coordination, and recognition terms.

Confidence Score: 5/5

The documentation-only change appears safe to merge, with the acknowledged repository-setting prerequisite tracked by the PR.

No concrete unacknowledged defect or independently actionable non-blocking issue remains in the added policy.

_{Reviews (1): Last reviewed commit: "docs: add security policy" | Re-trigger Greptile}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b962aed061

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Enable the private reporting channel before publishing

The commit notes confirm that private vulnerability reporting is currently disabled, so the only reporting route documented here does not expose a Report a vulnerability action. Because the policy also tells researchers not to use any public channel and provides no fallback email or contact method, security reports cannot be submitted at all until an administrator enables the repository setting; enable it before publishing this policy or document an already-operational confidential alternative.

Useful? React with 👍 / 👎.