Add a coordinated vulnerability reporting policy

[KingAkeem]

Why

TorBot is a widely used security and OSINT crawler that processes untrusted crawl content, but the default branch does not currently provide a SECURITY.md. Public issues are not an appropriate place for researchers to disclose crawler, dependency, or data-handling vulnerabilities.

A clear private reporting path would make responsible disclosure safer and give maintainers a consistent way to triage reports.

Proposed scope

• Add a SECURITY.md to the default branch.
• State which branches or releases currently receive security fixes.
• Make GitHub private vulnerability reporting the preferred channel, enabling it if needed.
• Define realistic, maintainer-approved acknowledgement and follow-up expectations.
• Explain how disclosure coordination will work.
• Warn reporters not to include credentials, private crawl targets, or sensitive crawl output in public issues.

Acceptance criteria

• The repository exposes a clear private vulnerability-reporting path.
• Supported versions or branches are documented.
• Reporters know what information to include and what must stay out of public issues.
• Response expectations are realistic and maintainable.
• The policy is linked from an appropriate contributor-facing location.

Reference

GitHub's repository security guidance recommends documenting supported versions and how vulnerabilities should be reported:

https://docs.github.com/en/code-security/getting-started/quickstart-for-securing-your-repository