docs: make security reporting operational

SECURITY.MD

@@ -1,51 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-Security updates are provided for actively maintained versions of this project.
-
-| Version | Supported |
-| ------- | --------- |
-| Latest release | :white_check_mark: |
-| Older releases | :x: |
-
-## Reporting a Vulnerability
-
-If you discover a security vulnerability in this project, please report it responsibly.
-
-Please do not disclose security vulnerabilities publicly through GitHub Issues, Pull Requests, or other public channels before the maintainers have had an opportunity to investigate.
-
-### How to Report
-
-Please use GitHub's private vulnerability reporting feature for this repository if it is available.
-
-If private vulnerability reporting is not available, contact the project maintainers through the repository's official GitHub channels and clearly identify the report as a security vulnerability.
-
-Please include:
-
-- A clear description of the vulnerability
-- The affected component, file, or feature
-- Steps to reproduce the issue
-- The potential security impact
-- Any proof-of-concept or relevant logs, if available
-- A suggested mitigation or fix, if you have one
-
-### What to Expect
-
-After receiving a vulnerability report, maintainers should:
-
-1. Acknowledge receipt of the report.
-2. Investigate and validate the reported issue.
-3. Determine the severity and affected versions.
-4. Develop and test an appropriate fix.
-5. Release or communicate the fix when appropriate.
-
-Please allow reasonable time for investigation and remediation before publicly disclosing the vulnerability.
-
-## Responsible Disclosure
-
-We appreciate responsible security research and coordinated disclosure.
-
-Security researchers are encouraged to avoid accessing, modifying, or deleting data belonging to others and to avoid actions that could disrupt services or users.
-
-Thank you for helping improve the security of this project.

SECURITY.md

@@ -0,0 +1,38 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes are applied to the latest commit on the `main` branch. This
+repository does not currently publish versioned releases, so older commits and
+forks are not maintained as separate security-support channels.
+
+## Report a vulnerability privately
+
+Please use [GitHub private vulnerability reporting](https://github.com/cathrynlavery/diagram-design/security/advisories/new).
+Do not disclose a suspected vulnerability in a public issue, pull request,
+discussion, or social-media post before we have coordinated disclosure.
+
+Include as much of the following as you can:
+
+- the affected file, script, or workflow;
+- a description of the impact and who could be affected;
+- clear reproduction steps or a minimal proof of concept;
+- any conditions required to exploit the issue;
+- a suggested mitigation, if you have one.
+
+Avoid including secrets, credentials, or personal data in the report.
+
+## What to expect
+
+We will acknowledge the report as soon as practical, validate the finding,
+determine its scope, and coordinate remediation and disclosure with the
+reporter. Please allow time for a fix to be developed and tested before public
+disclosure.
+
+## Good-faith research
+
+Please avoid accessing, modifying, or deleting data that does not belong to
+you, disrupting services, or degrading other users' experience. If testing
+could affect other people or systems, stop and submit a private report first.
+
+Thank you for helping keep Diagram Design and its users safe.