Add security policy for reporting vulnerabilities

This document outlines the security policy for reporting vulnerabilities in Endless Host Roles, including response times and disclosure guidelines.

SECURITY.md

@@ -0,0 +1,43 @@
+# Security Policy for Endless Host Roles (EHR)
+
+Ensuring the security of our community and mod is a top priority. This document explains how to responsibly report security issues and what to expect.
+
+---
+
+## 1. Reporting a Vulnerability
+
+If you discover a security vulnerability in EHR (either in-game exploits or issues in the mod code), please report it **privately** through the **[EHR Discord server](https://discord.gg/ehr)** by opening a support ticket.
+
+**Include as much information as possible:**
+
+- Steps to reproduce the issue  
+- Video footage or screenshots demonstrating the problem  
+- Logs from the mod (`log.html`, `LogOutput.log`, `Errorlog.log`)
+
+Providing all three is ideal to help us understand and fix the issue quickly.
+
+---
+
+## 2. Response Time
+
+We aim to respond to all security reports **within the same day** whenever possible.
+
+---
+
+## 3. Scope
+
+This policy applies to:
+
+- In-game exploits or bugs that could be abused  
+- Mod code vulnerabilities that could affect users or the community  
+
+---
+
+## 4. Disclosure
+
+- Please **do not publicly disclose** any vulnerabilities until a fix has been released.  
+- We will work to release a patch as soon as possible to resolve reported issues.
+
+---
+
+Thank you for helping us keep EHR safe and fair for all players. 💜