docs(repo): add security vulnerability disclosure policy

Author: hmza-hb

SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+## Supported versions
+
+| Version | Supported |
+|---------|-----------|
+| latest  | ✅        |
+
+## Reporting a vulnerability
+
+**Please do not open a public GitHub issue for security vulnerabilities.**
+
+If you discover a security issue in Cortex, please disclose it responsibly by emailing:
+
+**security@cortex-edr.com**
+
+Include:
+- A description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Any suggested fix (optional)
+
+You will receive a response within 48 hours. We will work with you to understand and resolve the issue before any public disclosure.
+
+## Scope
+
+This policy applies to the Cortex CLI codebase at `github.com/hamza-hafeez82/cortex`. It does not cover third-party dependencies — please report those upstream.