Add a security policy and move LICENSE to the root

SECURITY.md

@@ -0,0 +1,29 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest version on `master` is maintained.
+
+## Reporting a Vulnerability
+
+Please **do not** open a public issue for security problems, such as a script that could expose secrets or run untrusted code during setup.
+
+Instead, use one of these:
+
+- **GitHub Private Vulnerability Reporting** (preferred): use the [Report a vulnerability](https://github.com/FrancesCoronel/dotfiles/security/advisories/new) button on the Security tab.
+- **Email**: [frances@francescoronel.com](mailto:frances@francescoronel.com)
+
+Please include:
+
+- A description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Any suggested fix (optional)
+
+I aim to respond within **72 hours** and will keep you updated while the issue is investigated and fixed.
+
+## Scope
+
+In scope: the scripts and config in this repository.
+
+Out of scope: the third-party tools these dotfiles install (Homebrew packages, apps), which should be reported to their own maintainers.