docs: add comprehensive SECURITY.md policy

SECURITY.md

@@ -0,0 +1,56 @@
+# Security Policy
+
+## Supported Versions
+
+Only the following versions of this project are currently receiving security updates. We strongly recommend using the latest stable release.
+
+| Version   | Supported          | Support Type                        | End of Life |
+|-----------|--------------------|-------------------------------------|-------------|
+| 5.1.x     | :white_check_mark: | Full support (features + security)  | —           |
+| 5.0.x     | :white_check_mark: | Security updates only               | TBD         |
+| 4.0.x     | :white_check_mark: | Security updates only               | 2026-12-31  |
+| < 4.0     | :x:                | Not supported                       | —           |
+
+**Note**: Once a version reaches End of Life, it will no longer receive security patches. Please upgrade as soon as possible.
+
+## Reporting a Vulnerability
+
+**We take all security issues seriously.** If you believe you have found a security vulnerability, please report it responsibly so we can address it before public disclosure.
+
+### Preferred Reporting Methods
+
+1. **GitHub Security Advisories** (Recommended)  
+   [Report a vulnerability here](https://github.com/volta-cli/volta/security/advisories/new)
+
+2. **Email**  
+   Contact a maintainer (or `security@volta-cli.org` if available)
+
+### Our Response Process
+
+- **Initial Acknowledgment**: Within **48 hours**
+- **Triage & Assessment**: Within **5 business days**
+- **Status Updates**: At least every **7 days**
+- **Patch Release**: Target of **30 days** for high/critical issues
+
+We follow **Coordinated Vulnerability Disclosure (CVD)**. Reporters will be credited unless they prefer anonymity.
+
+### Scope
+
+**In scope:**
+- Vulnerabilities in the core codebase
+- Security issues in official dependencies
+- Configuration weaknesses in official documentation
+
+**Out of scope:**
+- Social engineering or phishing attacks
+- Physical access attacks
+- Denial of Service on infrastructure
+- Vulnerabilities in unsupported versions
+
+## Acknowledgments
+
+Thank you to the security researchers who help keep Volta secure, including **Saviour Josiah** for contributing this Security Policy.
+
+---
+
+**Legal Note**: By submitting a report, you agree to follow responsible disclosure practices.