docs: add SECURITY.md pointing to private vulnerability reporting (#237)

Researchers had no documented channel for reporting vulnerabilities, so
reports arrived by personal email. Point them to GitHub's private
vulnerability reporting (now enabled), list supported versions, and
spell out the function-source threat model.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: redonkulus

SECURITY.md

@@ -0,0 +1,31 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are released for the latest major version only.
+
+| Version | Supported |
+| ------- | --------- |
+| 7.x     | Yes       |
+| < 7.0   | No        |
+
+## Reporting a Vulnerability
+
+Please **do not** report security vulnerabilities through public GitHub issues, pull requests, or discussions.
+
+Instead, report them privately through GitHub's [private vulnerability reporting](https://github.com/yahoo/serialize-javascript/security/advisories/new). This opens a draft security advisory that only the maintainers can see, where we can discuss the issue with you, develop a fix, and coordinate disclosure.
+
+Please include:
+
+- The affected version(s)
+- A minimal reproduction (input, options, and the resulting output)
+- The context the output is used in (e.g. embedded in an HTML `<script>` element)
+- The impact you believe it has
+
+We will acknowledge your report as soon as we can, keep you updated on progress, and credit you in the published advisory unless you prefer otherwise.
+
+## Scope
+
+`serialize-javascript` escapes its output so it can be safely embedded in an HTML `<script>` element (unless `options.unsafe` is set). Reports that untrusted **data** (strings, object keys, regexps, dates, etc.) can break out of that context are in scope.
+
+Serializing a **function** emits its source text as code. If an attacker can control the source text of a function you serialize, they can already run code in your page, so that is not a vulnerability by itself. We still treat a function body that escapes the `<script>` element (for example, injecting HTML markup) as a defect and fix it, but it is considered low severity.