Add SECURITY.md vulnerability disclosure policy

[dmchaledev]

Summary

• This repository ships security policy templates for others but had no SECURITY.md of its own — there was no documented way to privately report a vulnerability.
• Adds a SECURITY.md that scopes reporting to the repo's actual attack surface: scripts/customize.sh (a shell script users run locally, invoked by CI) and the GitHub Actions workflows, e.g. shell-injection or supply-chain concerns.
• Routes GitHub's private vulnerability reporting (Security tab → "Report a vulnerability") as the primary channel, since guessing at a contact email risked being wrong.
• Explicitly redirects stale/incorrect compliance-citation content (e.g. wrong NIST CSF or ISO 27001 references) to regular GitHub issues, since those are content-accuracy problems, not vulnerabilities — several are already open (All 18 policy templates cite superseded NIST CSF v1.1 codes, inconsistent with mappings/nist-csf.md's CSF 2.0 upgrade #53, docs/framework_mapping.md is an orphaned, stale duplicate of /mappings — cites NIST CSF v1.1 and isn't linked from README or anywhere else #55, mappings/nist-csf.md — the file cited as the CSF 2.0 source of truth still contains ID.SC and PR.IP, two categories CSF 2.0 removed #58, Framework mapping docs are missing the MFA and Ransomware Response policies #59) and shouldn't be funneled into a security-disclosure channel.

Test plan

• Reviewed rendered Markdown locally for formatting
• N/A — documentation-only change, no code paths affected

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

https://claude.ai/code/session_01GJhDBGPn8Wn33FFJh47mcu

---

Generated by Claude Code