Add SECURITY.md with vulnerability reporting instructions

[Copilot]

This PR adds a comprehensive SECURITY.md file to establish clear security policies and vulnerability reporting procedures for the Live Background Removal Lite project.

Changes Made

• Added SECURITY.md: Creates a professional security policy document that includes:

  • Clear statement that "we always provide secured software with users at the latest release"
  • Vulnerability reporting process with dedicated security contact: umireon+security@kaito.tokyo
  • Timeline expectations for vulnerability handling (48h acknowledgment, 5-day assessment, 30-day resolution)
  • Responsible disclosure guidelines to protect users
  • Security best practices for end users
  • Support version matrix indicating security updates are provided for latest releases only

• Updated .gitignore: Added !SECURITY.md to the exception list to ensure the security policy file is properly version controlled (the project uses an exclude-all approach in .gitignore)

Security Contact

The security policy establishes umireon+security@kaito.tokyo as the dedicated contact for vulnerability reports, separate from general project communications, enabling proper security issue triage and handling.

Compliance

The implementation follows:

• GitHub security best practices for open source projects
• Project development guidelines (proper file endings, markdown formatting)
• Consistent styling with existing project documentation (README.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md)

This security policy will help protect users by providing a clear, professional channel for security researchers and users to report vulnerabilities responsibly.

Original prompt

Add SECURITY.md. We always provides secured software with users at the latest release. If you find vulnerability, report it to umireon+security@kaito.tokyo.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull Request Overview

Adds a new SECURITY.md to define vulnerability reporting, supported versions, disclosure expectations, and user security best practices. Also updates .gitignore (not shown in diff) to ensure SECURITY.md is tracked.

• Introduces formal vulnerability reporting workflow and timelines
• Documents supported version policy (latest release only)
• Provides contact channel for security issues

[umireon]

@copilot Improve document according to the review

[Copilot]

@copilot Improve document according to the review

Could you please specify what aspects of the SECURITY.md document need improvement? I'd like to make sure I address your specific concerns correctly.