docs: add SECURITY.md

[AntTheLimey]

Adds SECURITY.md to the repository root. It names security@pgedge.com as
the single reporting route and points at the pgEdge Vulnerability Disclosure
Statement for scope, safe harbour and CVE handling.

The file is identical in every pgEdge product repository — nothing in it is
repo-specific.

Why an in-repo copy when there is an org default

pgEdge/.github carries the same file as an organisation default, which covers
every repository that has none of its own. Defaults do not appear in a
repository's file tree, git history, clones or release archives — only in the
Security tab. A product a customer clones or vendors should carry its own
policy, and OpenSSF Scorecard's security-policy check only looks in the
repository itself.

Draft on purpose — merge order matters

The only link in this file is https://docs.pgedge.com/security, and that URL
returns 404 today. Merging before the statement is live publishes a
security policy whose one actionable link is dead.

Merge order:

1. docs: add vulnerability disclosure statement pgedge-docs#138 — publishes docs.pgedge.com/security. Out of
   draft and awaiting review.
2. docs: add org-wide SECURITY.md default .github#6 — the org-wide default.
3. This PR, alongside the other product repositories.

No action needed from you until #138 merges. Reviews welcome now.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 5cf15e9d-467e-4878-8acc-266fd1ef597a

📥 Commits

Reviewing files that changed from the base of the PR and between c6d8df4 and 192a423.

📒 Files selected for processing (1)

• SECURITY.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

Adds SECURITY.md with instructions for private vulnerability reporting, required report details, response timelines, supported-version rules, safe harbour terms, testing authorization requirements, and advisory publication locations. It directs reporters to the pgEdge Vulnerability Disclosure Statement for scope, coordinated disclosure, and CVE handling.

Merge Risk: ⚪ Minimal · up to 192a4

This adds a repository-local security policy document with no actionable merge-blocking risk remaining after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the new SECURITY.md file, its purpose, and the dependency on the documentation link becoming available.
Title check	✅ Passed	The title clearly and concisely identifies the addition of SECURITY.md documentation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/security-policy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}