Bring SurvivorCore's coordinated-disclosure setup in line with the sibling
public repo: a public engine consumed by other games has the same
"public issue = public exploit" risk.
- SECURITY.md: private "Report a vulnerability" channel (GitHub Security
Advisories), coordinated disclosure (ack → fix privately → release →
publish advisory + CVE + credit), supported-versions = latest release,
scope = engine code in this repo (games' own code/content out of scope),
and the Roblox-specific "never trust the client / validate RemoteEvents"
guidance. Notes selene + luau-lsp as the code-scanning equivalent since
Luau isn't CodeQL-supported.
- CONTRIBUTING: point would-be reporters to the private channel, and
document the multi-issue-close convention (separate `Closes #N` each).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
