[haseebahmed248]

Summary

The security policy still describes a design-only project. Update it for the published alpha, give reporters a direct private route, and explain the boundaries of the existing runtime checks.

Related issue

Closes #41

Changes

• Replace the obsolete release status and describe implemented controls separately from planned features.
• Link to GitHub private vulnerability reporting and ask for minimal, sanitized reproductions.
• Explain trusted host/adaptor execution, cancellation, cost-accounting and event-log limits without adding support promises.

Validation

• Checked the controls against the compiler, runtime, CLI host loading, event recorder and provider documentation.
• Confirmed the published npm alpha and matching GitHub prerelease exist.
• The GitHub reporting API initially returned enabled: false. With maintainer approval, enabled private vulnerability reporting and verified enabled: true afterward. No other security settings were changed.
• Verified the reporting URL matches the existing issue chooser and that the obsolete design-only claims are removed.
• git diff --check passed.
• Application type, generated-contract and runtime tests were not rerun locally because this PR changes only SECURITY.md; CI can run the standard checks.

Risk and compatibility

• Security or permission effects: documents existing boundaries; private reporting was enabled separately with approval. Runtime permissions are unchanged.
• Compatibility or breaking changes: none. No production-readiness, response-time, backport or long-term support commitments are introduced.

Checklist

• This change is focused on one issue.
• Documentation statements and the reporting route were verified; no code behavior changes.
• Unsupported security features are distinguished from implemented checks.
• No generated files are changed.
• No credentials, private data, or unredacted model output are included.
• The commit includes the required DCO Signed-off-by line.