feat: enhance SECURITY.md with comprehensive vulnerability disclosure policy

- Add supported versions table for all commit-check projects
- Add GitHub Security Advisories links as preferred reporting channel
- Add detailed vulnerability report template (version, type, PoC, etc.)
- Add clear response timeline (48h acknowledge, 5d triage, 14d fix)
- Add coordinated disclosure process description
- Add PGP key placeholder for future encrypted communication
- Add security best practices for users
- Add acknowledgments section

Author: shenxianpeng

SECURITY.md

@@ -1,21 +1,86 @@
 # Security Policy
 
-If you find a security vulnerability in any Commit Check project, please report it privately.
+The **Commit Check** project takes the security of its software seriously. This document outlines our vulnerability disclosure process and supported versions.
+
+## Supported Versions
+
+Only the **latest** release of each project (`commit-check`, `commit-check-action`, `commit-check-mcp`) receives security patches.
+
+| Project | Supported |
+|---------|-----------|
+| commit-check (PyPI) | ✅ Latest release only |
+| commit-check-action | ✅ Latest release only |
+| commit-check-mcp | ✅ Latest release only |
+| Older versions | ❌ Not supported |
+
+Please keep your dependencies up to date.
 
 ## Reporting a Vulnerability
 
-**Do not open a public GitHub issue.** Instead, send an email to:
+**Do not open a public GitHub issue.** If you discover a security vulnerability in any Commit Check project, please report it privately.
+
+### Preferred: GitHub Security Advisories
+
+Use the **"Report a vulnerability"** feature on the relevant repository:
+
+- https://github.com/commit-check/commit-check/security/advisories/new
+- https://github.com/commit-check/commit-check-action/security/advisories/new
+- https://github.com/commit-check/commit-check-mcp/security/advisories/new
+
+This allows us to triage and patch the issue privately before public disclosure.
+
+### Alternative: Email
+
+If you cannot use the GitHub Security Advisories feature, send an email to:
 
 **[xianpeng.shen@gmail.com](mailto:xianpeng.shen@gmail.com)**
 
-Please include:
+### What to Include
 
-- Which project and version is affected
-- A description of the issue and its impact
-- Steps to reproduce (or a proof of concept)
+Please provide as much of the following information as possible:
 
-You will receive an acknowledgment within 48 hours, followed by a plan for resolution.
+- **Project and version** affected (e.g., commit-check v2.15.0)
+- **Type of vulnerability** (e.g., arbitrary code execution, denial of service, information disclosure)
+- **Description** of the issue and its potential impact
+- **Steps to reproduce** or a proof of concept (PoC)
+- **Affected components** (e.g., CLI, GitHub Action, MCP Server)
+- **Any suggested mitigation** (if known)
 
-## Supported Versions
+### What to Expect
+
+| Step | Timeframe |
+|------|-----------|
+| Acknowledgment | Within 48 hours |
+| Initial assessment & triage | Within 5 business days |
+| Fix development | Within 14 days (critical issues) |
+| Coordinated disclosure | After a patch is released |
+
+We will keep you informed of progress throughout the process.
+
+## Coordinated Disclosure
+
+We believe in responsible disclosure. We will:
+
+1. Work with the reporter to understand and validate the issue
+2. Develop and test a fix in a private fork
+3. Release a patched version
+4. Credit the reporter in the release notes (if they wish)
+
+We ask reporters to give us a reasonable timeframe to address the issue before public disclosure.
+
+## PGP Key
+
+If you need to communicate sensitive information via encrypted email, you can use the following PGP key:
+
+> **Note:** A PGP key will be published here once generated. In the meantime, please use GitHub Security Advisories or the contact email above.
+
+## Security best practices for users
+
+- Always use the **latest version** of Commit Check tools
+- Verify artifact attestations when using GitHub Action (we provide SLSA attestation for releases)
+- Review commit signatures in sensitive environments
+- Use branch protection rules alongside Commit Check
+
+## Acknowledgments
 
-Only the latest release of each project receives security patches. Please keep your dependencies up to date.
+We thank the security researchers and community members who responsibly disclose vulnerabilities to us.