add SECURITY.md policy

SECURITY.md

@@ -0,0 +1,21 @@
+# Security Policy
+
+## Supported Versions
+
+We actively support and patch security issues in the following versions of `oh-my-opencode-slim`:
+
+| Version | Supported |
+| ------- | --------- |
+| 2.2.x   | ✅ Yes    |
+| < 2.2   | ❌ No     |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this project, please do not open a public issue. Instead, use GitHub's private vulnerability reporting at https://github.com/alvinunreal/oh-my-opencode-slim/security/advisories/new, or reach out to @alvinunreal directly.
+
+Please include:
+1. Detailed description of the vulnerability.
+2. Steps to reproduce or proof-of-concept code.
+3. Impact assessment.
+
+We will acknowledge receipt of your report within 48 hours and provide a timeline for coordination and patching.