docs: add SECURITY.md with vulnerability disclosure policy (#651)

* docs: add SECURITY.md with vulnerability disclosure policy

* docs: revert table formatting as per review

* docs: revert supported versions table to original format

Author: yachikadev

SECURITY.md

@@ -2,20 +2,18 @@
 
 ## Supported Versions
 
-The following versions of **DevCard** are currently supported with security updates:
+## Supported Versions
 
 | Version | Supported          |
 | ------- | ------------------ |
 | main    | ✅ Yes             |
 
 ## Reporting a Vulnerability
 
-If you discover a security vulnerability in **DevCard**, please **do not open a public issue**.
-
-Instead, report it responsibly by:
+Please report via **GitHub Private Security Advisory**:
+[Report here](https://github.com/Dev-Card/DevCard/security/advisories/new)
 
-- 📧 Reaching out to the maintainer directly via their [GitHub profile](https://github.com/Dev-Card)
-- 💬 Sending a private message through GitHub's messaging or social links listed in the profile
+**Do NOT open a public issue for security vulnerabilities.**
 
 ### What to include in your report:
 - A clear description of the vulnerability
@@ -25,18 +23,30 @@ Instead, report it responsibly by:
 
 ## Response Timeline
 
-| Action                        | Timeframe         |
-| ----------------------------- | ----------------- |
-| Acknowledgement of report     | Within 48 hours   |
-| Status update                 | Within 7 days     |
-| Patch / fix release           | Within 30 days    |
+- Acknowledgement: within 48–72 hours
+- Status update: within 7 days
+- Patch / fix release: within 30 days
+
+## In Scope
+- Authentication bypass
+- Sensitive data exposure via API endpoints
+- XSS in profile/card rendering
+- Unauthorized access to user contact data
+
+## Out of Scope
+- Rate limiting / brute force without impact
+- Spam or social engineering
+- Issues in third-party dependencies (report upstream)
 
 ## Responsible Disclosure
 
-We follow a **responsible disclosure** policy. Please give us adequate time to patch the issue before any public disclosure. We deeply appreciate security researchers who help keep **DevCard** safe. 🙏
+Please give us adequate time to patch the issue before any public disclosure.
+We deeply appreciate security researchers who help keep **DevCard** safe. 🙏
 
-## References
+## Acknowledgements
+
+Responsible reporters will be credited in release notes (with permission).
 
-- [DevCard Repository](https://github.com/Dev-Card/DevCard)
-- [GitHub Security Advisories](https://docs.github.com/en/code-security/security-advisories)
-- [Adding a Security Policy to your repo](https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository)
+## References
+- [GitHub Security Advisories Docs](https://docs.github.com/en/code-security/security-advisories)
+- [Adding a Security Policy](https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository)