Add SECURITY.md for vulnerability reporting guidelines

SECURITY.md

@@ -0,0 +1,36 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues, discussions, or social media.**
+
+Instead, email us at **[support@branta.pro](mailto:support@branta.pro)**.
+
+### What to include
+
+To help us triage and resolve the issue quickly, please include:
+- A description of the vulnerability and its potential impact
+- Step-by-step instructions to reproduce the issue
+- The affected version(s) of the Branta SDK, your platform, and implementation details
+- Any proof-of-concept code, logs, or screenshots (please redact any sensitive credentials)
+- Whether the issue has been disclosed anywhere else
+
+### What to expect
+
+- We will acknowledge your report as soon as possible and keep you informed as we investigate
+- We will work with you to understand and validate the issue
+- Once a fix is released, we are happy to credit you for the discovery if you would like
+
+We ask that you give us a reasonable amount of time to address the issue before any public disclosure.
+
+## Scope
+
+Reports of particular interest include:
+- Authentication bypass or privilege escalation
+- Exposure of sensitive data or credentials
+- Remote code execution vulnerabilities
+- Payment transaction handling flaws
+- Privacy leaks or data exposure issues
+- Vulnerabilities in Branta infrastructure that users depend on
+
+Issues in third-party dependencies should be reported upstream to the respective projects, though we appreciate a heads-up if Branta is affected.