Create SECURITY.md

Author: cezaraugusto

.github/SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Reporting Security Issues
+
+If you believe you’ve found a security vulnerability in Extension.js, we encourage you to report it right away.
+
+We will investigate all legitimate reports and work quickly to fix the problem.
+
+Our preferred method is to use GitHub’s private vulnerability reporting feature. To disclose a potential security issue:
+
+1. Go to the [Security tab](../../security/advisories) of this repository.
+2. Click **"Report a vulnerability"**.
+3. Provide as much detail as possible, including reproduction steps or a proof-of-concept if applicable.
+
+Please avoid filing public issues for security-related matters.
+
+Thank you for helping keep Extension.js safe for everyone.