docs: add SECURITY.md

Directs vulnerability reports to the contact form at oai.pm instead of
public issues.

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+oAI-Web is a self-hosted personal agent that can read your email, calendar, and files, and take real actions on your behalf. We take security issues seriously and appreciate responsible disclosure.
+
+## Reporting a Vulnerability
+
+**Please do not open a public GitLab/GitHub issue for security vulnerabilities.**
+
+Instead, report it privately through the contact form at:
+
+**[https://oai.pm/#contact](https://oai.pm/#contact)**
+
+Include as much detail as you can:
+
+- A description of the vulnerability and its potential impact
+- Steps to reproduce (proof-of-concept code or requests, if applicable)
+- The affected version/commit
+- Any suggested mitigation, if you have one
+
+You should receive an acknowledgement of your report. We'll keep you updated as the issue is investigated and fixed, and we're happy to credit you in the release notes once a fix ships, if you'd like.
+
+## Scope
+
+This policy covers the oAI-Web server, its tools, and the web interface in this repository. It does not cover third-party services you configure (e.g. your AI provider, mail server, or CalDAV host) - please report issues in those directly to their maintainers.
+
+## Supported Versions
+
+Only the latest release on the `main` branch is actively supported with security fixes. If you're running an older version, please upgrade before reporting an issue, as it may already be resolved.