docs: add security policy and social preview

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release is supported with security updates.
+
+## Reporting a Vulnerability
+
+Please report security vulnerabilities through GitHub's private vulnerability reporting:
+
+1. Go to the [Security tab](https://github.com/baudsmithstudios/vigil/security)
+2. Click **"Report a vulnerability"**
+3. Fill out the advisory form with a description, severity, and affected versions
+
+This creates a private advisory visible only to you and the maintainers. Please do not open a public issue for security vulnerabilities.
+
+## What to Expect
+
+- Acknowledgment within 72 hours
+- A fix or mitigation plan within 14 days for confirmed vulnerabilities
+- Credit in the advisory and changelog unless you prefer to remain anonymous