docs: add security policy with vulnerability reporting guidelines

- Support only latest version for security updates
- Use GitHub's private vulnerability reporting feature
- Set realistic response timelines for personal project maintenance
- Include clear guidelines for responsible disclosure

Author: Mubashwer

SECURITY.md

@@ -0,0 +1,49 @@
+# Security Policy
+
+## Supported Versions
+
+We currently support security updates for the following versions of git-mob:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| Latest  | :white_check_mark: |
+| Others  | :x:                |
+
+Only the latest version receives security updates. We recommend always using the most recent version available.
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in git-mob, please report it responsibly:
+
+### Reporting Process
+
+1. **Do not** create a public GitHub issue for security vulnerabilities
+2. Instead, please use GitHub's private vulnerability reporting feature:
+   - Go to the [Security tab](https://github.com/Mubashwer/git-mob/security) of this repository
+   - Click "Report a vulnerability"
+   - Fill out the vulnerability report form with as much detail as possible
+
+### What to Include
+
+When reporting a vulnerability, please include:
+
+- A clear description of the vulnerability
+- Steps to reproduce the issue
+- Potential impact assessment
+- Any suggested fixes or mitigations (if you have them)
+
+### Response Timeline
+
+- We will acknowledge receipt of your vulnerability report within **1 week**
+- We aim to provide an initial assessment within **2-3 weeks**
+- We will keep you updated on our progress toward a fix
+- Once a fix is available, we will coordinate with you on disclosure timing
+
+Please note that this is a personal project maintained in spare time, so response times may vary.
+
+### What to Expect
+
+- **If accepted**: We will work on a fix and release a security update. You will be credited for the discovery (unless you prefer to remain anonymous)
+- **If declined**: We will provide a clear explanation of why the report does not qualify as a security vulnerability
+
+Thank you for helping to keep git-mob secure!