add security.md

[shawn0915]

Summary

• What changed?

Add security.md file.

• Why is this needed?

To allow raise issue about security.

Validation

• Backend tests passed
• Frontend typecheck/build passed
• OpenAPI SDK regenerated or checked when API contracts changed
• Smoke test run when relevant

Commands run:

# paste commands here

Risk

• User-facing impact:
• Deployment or migration impact:
• Rollback approach:

Notes

• Related issue:
• Follow-up work:
• Docs or operator runbooks updated when behavior changed:

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive SECURITY.md file that details the project's security architecture, vulnerability reporting process, and deployment security checklist. Feedback from the review highlights the need to provide a direct security contact email instead of referring to an incomplete CODE_OF_CONDUCT.md and recommends removing the hardcoded default bootstrap password from the public documentation to mitigate potential security risks.

[gemini-code-assist]

The instruction to report vulnerabilities via email by referring to CODE_OF_CONDUCT.md is currently broken because the provided CODE_OF_CONDUCT.md does not contain any email addresses or specific contact details. It only mentions a "private maintainer channel" without defining how to access it. This creates a barrier for security researchers. Please provide a direct security email address or update CODE_OF_CONDUCT.md with the necessary contact information.

Suggested change

	- **Email**: Send a detailed report to the maintainers via private channels listed in the repository's `CODE_OF_CONDUCT.md`
	- **Email**: [Insert security contact email address]

[gemini-code-assist]

Hardcoding the default bootstrap password in the public SECURITY.md file is a security risk, as it makes it trivial for attackers to find and attempt to use these credentials against unconfigured instances. It is safer to refer to the .env.release.example file or an environment variable (e.g., BOOTSTRAP_ADMIN_PASSWORD) without disclosing the actual default string in the security policy.

Suggested change

	- Password: `ChangeMe!2026`
	- Password: See the default value in .env.release.example