Add a security policy: report privately via GHSA, not the issue tracker

[jeremy]

Surfguard is an SSRF guard, so classification bugs are vulnerabilities — the kind of report this repo should route privately, and today nothing tells a researcher how.

This adds a SECURITY.md:

• Reporting: GitHub private vulnerability reporting (already enabled on this repo), with a direct link to the advisory form. HackerOne (https://hackerone.com/basecamp) accepted as an alternative for researchers who want the report on their H1 record — no bounty, per the 37signals response policy.
• What qualifies: a blocked-range address classified as public, a resolution path that lets a blocked address through, or a validate-vs-connect discrepancy under the documented pinning contract. Non-security bugs → issue tracker.
• Supported versions: latest release only.
• Expectations: acknowledgment, GHSA-coordinated fix and disclosure, reporter credit.

The README gains a short "Security" section linking the policy by absolute URL, so it works from GitHub and from the packaged gem (which ships README.md but not SECURITY.md). Gemspec untouched — SECURITY.md is a repo artifact, not gem payload.

Pairs with basecamp/.github#17, which adds the org-wide default; this repo-specific policy takes precedence for surfguard.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3bb7a96477

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Adds private vulnerability-reporting guidance for Surfguard and links it from the README.

Changes:

• Defines qualifying vulnerabilities, supported versions, and disclosure expectations.
• Directs reports to GitHub Security Advisories or HackerOne.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
SECURITY.md	Adds the repository security policy.
README.md	Links readers to the security policy.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.