docs: add SECURITY.md with vulnerability reporting policy

SECURITY.md

@@ -0,0 +1,42 @@
+# Security Policy
+
+## Supported Versions
+
+The following versions of **DevCard** are currently supported with security updates:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| main    | ✅ Yes             |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in **DevCard**, please **do not open a public issue**.
+
+Instead, report it responsibly by:
+
+- 📧 Reaching out to the maintainer directly via their [GitHub profile](https://github.com/Dev-Card)
+- 💬 Sending a private message through GitHub's messaging or social links listed in the profile
+
+### What to include in your report:
+- A clear description of the vulnerability
+- Steps to reproduce the issue
+- Potential impact assessment
+- Any suggested fix (optional but appreciated)
+
+## Response Timeline
+
+| Action                        | Timeframe         |
+| ----------------------------- | ----------------- |
+| Acknowledgement of report     | Within 48 hours   |
+| Status update                 | Within 7 days     |
+| Patch / fix release           | Within 30 days    |
+
+## Responsible Disclosure
+
+We follow a **responsible disclosure** policy. Please give us adequate time to patch the issue before any public disclosure. We deeply appreciate security researchers who help keep **DevCard** safe. 🙏
+
+## References
+
+- [DevCard Repository](https://github.com/Dev-Card/DevCard)
+- [GitHub Security Advisories](https://docs.github.com/en/code-security/security-advisories)
+- [Adding a Security Policy to your repo](https://docs.github.com/en/code-security/getting-started/adding-a-security-policy-to-your-repository)