add SECURITY.md file with new email

[basantagoswami]

No description provided.

[claude]

Claude finished @basantagoswami's task in 1m 2s —— View job

---

Review of PR #2566 — add SECURITY.md

• Gather context (read SECURITY.md, PR metadata)
• Verify diff against origin/develop
• Review content for correctness/security issues
• Post review summary

Summary

The PR adds a single 9-line SECURITY.md establishing security@bullbitcoin.com as the private vulnerability-reporting channel. The diff is exactly as described (1 file, +9/-0), there are no conflicting security-contact mentions elsewhere in the repo's markdown, and a docs-only change like this can't introduce correctness bugs or regressions. No blocking issues — LGTM with a few suggestions below.

Note: I can't submit a formal GitHub review with inline comments, so findings are listed here instead.

Suggestions (non-blocking)

1. No encrypted reporting channel (SECURITY.md:5). Vulnerability reports for a Bitcoin wallet can contain highly sensitive details (fund-loss exploits, key-handling flaws), but plain email is unencrypted in the reporter's mailbox and potentially in transit. Consider publishing a PGP key for security@bullbitcoin.com, and/or enabling GitHub Private Vulnerability Reporting on this repo and linking it here — GitHub also surfaces SECURITY.md in the repo's Security tab, so the two work well together. Fix this →

2. No response-time commitment (SECURITY.md:9). "We will acknowledge your report" has no timeframe. A concrete SLA (e.g., "we will acknowledge within 3 business days") sets reporter expectations and reduces the chance of premature public disclosure.

3. Consider a Supported Versions section. GitHub's SECURITY.md convention includes which versions receive security fixes — useful for a mobile app where old releases linger on devices. Optional for a first iteration.

4. Verify the mailbox. I can't confirm from here that security@bullbitcoin.com exists and is actively monitored — since the PR title says "with new email", please double-check the address is live before merging, as a bouncing security contact is worse than none.

---