Create Security Policy document

Security.MD

@@ -0,0 +1,43 @@
+# Security Policy
+
+## Supported Versions
+
+Aoba Client is currently under active development. Security support follows the latest stable release and the master branch.
+
+| Version | Supported |
+| --------------------- | ------------------ |
+| Latest stable release | :white_check_mark: |
+| `master` branch       | :white_check_mark: |
+| Older releases        | :x: |
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+For vulnerabilities affecting Aoba Client, please use GitHub's private security reporting mechanism:
+**GitHub → Security → Advisories → Report a vulnerability**
+
+When reporting an issue, please include:
+* A clear description of the vulnerability
+* The affected Aoba Client version or commit
+* The Minecraft version used
+* The affected component or package
+* Minecraft Launcher and Operating System
+* Steps required to reproduce the issue
+* Any relevant logs, configuration, screenshots, or proof-of-concept information
+* The potential security impact
+* A suggested mitigation, if known
+
+Please provide enough information for the issue to be reproduced and investigated.
+
+## Response Process
+
+We will make a reasonable effort to:
+1. Acknowledge a vulnerability report.
+2. Investigate and reproduce the issue.
+3. Determine its severity and affected versions.
+4. Develop and test a fix where practical.
+5. Release or document the appropriate mitigation.
+6. Publish a security advisory when disclosure is appropriate.
+
+Response and remediation times may vary depending on the severity, complexity, affected hardware, and whether the issue involves Aoba Client code or an upstream dependency.