fix(security): add coordinated disclosure timeline per GB review

Author: Patch76

SECURITY.md

@@ -49,7 +49,7 @@ and place it behind a TLS-terminating reverse proxy.
 Use the private reporting page at:
 **https://github.com/homeassistant-ai/ha-mcp/security/advisories/new**
 
-Reports are assessed within 48 hours; fixes may take an additional 24–48 hours.
+Reports are assessed within 48 hours; fixes may take an additional 24–48 hours. We aim for coordinated disclosure and will work with you to agree on a disclosure timeline, typically within 90 days of the initial report.
 Severity is assessed using CVSS base scores where applicable.
 
 **Requirements for a valid report:**