[li041]

Expanded the security policy to include detailed reporting guidelines, supported versions, and security boundaries. Added sections on trusted components and out-of-scope vulnerabilities.

[agicy]

LGTM.

[m2kar]

Hi @li041 @li041 .

Although the SECURITY.md file states that vulnerabilities can alternatively be reported through GitHub's privately report a vulnerability feature (Security tab → Report a vulnerability), I could not find the corresponding reporting button on the GitHub repository page.

Alternatively, GitHub's *privately report a vulnerability* feature (Security tab → Report a vulnerability) may be used.

If a security vulnerability is discovered, what channels are available to request a GitHub Security Advisory (GHSA) ID or a CVE identifier?

For independent security researchers, obtaining a GHSA or CVE identifier is also an important form of formal recognition and attribution for their contributions to open-source security.

[m2kar]

Could you please open the Private vulnerability reporting feature for this repo?

[agicy]

Could you please open the Private vulnerability reporting feature for this repo?

Enabled.

[m2kar]

the Report Vulnerability buttion worked👍