Portfolio polish: add security policy and showcase readiness notes

Author: FoxSecIntel

SECURITY.md

@@ -0,0 +1,29 @@
+# Security Policy
+
+## Supported Versions
+
+The `main` branch is actively maintained.
+
+## Reporting a Vulnerability
+
+Please report vulnerabilities privately and responsibly.
+
+- Preferred: open a private security advisory on GitHub.
+- Alternative: open an issue marked `security` without disclosing exploit details.
+
+Please include:
+
+- affected repository and version/commit
+- reproduction steps
+- impact assessment
+- suggested remediation, if known
+
+## Response Targets
+
+- Initial acknowledgement: within 3 business days
+- Triage decision: within 7 business days
+- Remediation timeline: based on severity and exploitability
+
+## Disclosure
+
+Coordinated disclosure is preferred. Public disclosure is encouraged after a fix is available.