Add comprehensive security policy and vulnerability reporting process

[joseph-isaacs]

Summary

This PR establishes a formal security policy for the Vortex project, including vulnerability reporting procedures, response targets, and CRA stewardship details. It updates the README to reference the new policy and ensures proper licensing attribution.

Changes

• Added SECURITY.md: Comprehensive security policy covering:

  • Vulnerability reporting procedures with email contact (security@vortex.dev)
  • Response time targets (3 business days for regular reports, 24 hours for emergency reports)
  • Regular process workflow (report → acknowledge → triage → fix → release → disclose)
  • Emergency process for actively exploited vulnerabilities and severe incidents
  • Supported versions policy (fixes released in next release from develop, no backports)
  • CRA stewardship framework under LF AI & Data Foundation and Linux Foundation
  • Guidance on intended use and regulatory responsibilities

• Updated README.md: Changed vulnerability reporting email from vuln-report@vortex.dev to security@vortex.dev and added reference to the new SECURITY.md policy document

• Updated REUSE.toml: Added SECURITY.md to the list of utility code files with CC-BY-4.0 licensing to ensure proper REUSE compliance

Testing

No testing needed. This is a documentation and configuration change establishing security policies and procedures.

https://claude.ai/code/session_01Fu5zHeqpJasT5RrS3VHNFV

[codspeed-hq]

Merging this PR will regress 2 benchmarks

⚠️ Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

⚠️ Different runtime environments detected

Some benchmarks with significant performance changes were compared across different runtime environments,
which may affect the accuracy of the results.

Open the report in CodSpeed to investigate

⚡ 2 improved benchmarks
❌ 2 regressed benchmarks
✅ 2168 untouched benchmarks
⏩ 206 skipped benchmarks¹

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Mode	Benchmark	BASE	HEAD	Efficiency
❌	Simulation	random_i16[0.8]	73.9 µs	92.2 µs	-19.83%
❌	Simulation	allocate_drop_bytes[0]	466 ns	520.2 ns	-10.41%
⚡	Simulation	random_i16[0.95]	94.4 µs	76.9 µs	+22.82%
⚡	Simulation	decompress[u64, (4000, 1024)]	85.6 µs	70.4 µs	+21.67%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing claude/vortex-eu-cra-compliance-6dky8g (108a78a) with develop (792cef7)}

Footnotes

1. 206 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩