fix(rhodibot): automated RSR compliance fixes

- Created missing

Co-Authored-By: rhodibot <rhodibot@hyperpolymath.dev>

Author: rhodibot

SECURITY.md

@@ -0,0 +1,13 @@
+<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
+# Security Policy
+
+## Reporting a Vulnerability
+
+**Email:** j.d.a.jewell@open.ac.uk
+
+**Response timeline:**
+- Acknowledgement within 48 hours
+- Initial assessment within 7 days
+- Fix or mitigation within 90 days
+
+**Safe harbour:** We will not pursue legal action against security researchers who follow responsible disclosure.