Add security policy with reporting guidelines

[loopghost]

Summary

This PR adds a SECURITY.md file that documents:

• The primary vulnerability disclosure channel through Immunefi
• An alternative private reporting channel for researchers who are unable to access Immunefi
• Reward eligibility parity for valid reports submitted outside Immunefi
• Coordinated disclosure expectations
• Safe harbor language for good-faith security research

Why this is useful

While Spark already has an active bug bounty program on Immunefi, adding a SECURITY.md provides a standard, repository-native security policy and ensures that researchers can quickly find the preferred disclosure process directly from the repository.

It also establishes a fallback private reporting path for legitimate researchers who cannot access Immunefi for technical or account-related reasons.

Additional Maintainer Action Required

To enable GitHub's built-in private disclosure workflow referenced in this policy, maintainers will need to enable Private Vulnerability Reporting in the repository settings:

Repository → Settings → Security → Advanced Security → Private vulnerability reporting → Enable

Once enabled, a "Report a vulnerability" button will appear under the Security tab, allowing researchers to submit reports privately through GitHub Security Advisories.

Reward Eligibility

The proposed policy states that valid reports submitted through GitHub Private Vulnerability Reporting should be evaluated under the same criteria and reward tiers as the existing Immunefi program.

---

Note

Low Risk
Documentation-only change that adds a repository security policy; no code paths or runtime behavior are affected.

Overview
Adds a new SECURITY.md documenting the preferred vulnerability reporting channel (Immunefi) with alternative private reporting options (GitHub private vulnerability reporting or email), plus expectations around reward eligibility parity, coordinated disclosure, and safe-harbor guidelines for good-faith research.

^{Reviewed by Cursor Bugbot for commit 716da75. Bugbot is set up for automated code reviews on this repo. Configure here.}

[loopghost]

cc: @turkycat @coreymartin @zhenlu @keenan-lightspark @lightsparkmax @reverendken @alexjweil

Hi all, I have opened this PR to add a SECURITY.md policy that complements the existing Immunefi program and provides an alternative private reporting path for researchers who are unable to access Immunefi.

In particular, the policy proposes that valid findings submitted through GitHub Private Vulnerability Reporting (once enabled) be evaluated under the same criteria and reward tiers as the live Immunefi program.

I believe this closes an important disclosure gap and makes the repository's security process much clearer and more accessible.

Thanks for taking a look.