add SECURITY.md (security policy, org contact)

SECURITY.md

@@ -0,0 +1,27 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Report vulnerabilities privately to **gasyoun@gmail.com** — the same
+contact address this repository's code of conduct carries. Please do not open
+a public issue for a security problem.
+
+- Include reproduction steps and, where possible, the commit or release affected.
+- This is an individually maintained academic estate: replies are best-effort,
+  there is no dedicated security team and no SLA.
+- Coordinated disclosure: please allow up to 90 days before public disclosure.
+  Credit is given unless you prefer otherwise.
+
+## Scope
+
+This policy covers the code and documentation in this repository
+(`VisualDCS`). Dependencies are covered by their own upstream policies —
+report their vulnerabilities upstream.
+
+## Licence
+
+This repository is licensed under Apache License 2.0 (see the LICENSE file).
+## Attribution
+
+Deployed by `cologne_batch_deploy.py` (security-md, H7156); edit the row, not
+each repository's copy.