docs: add SECURITY.md for private vulnerability reporting (#2305)

Provide a clear private disclosure path so researchers are not forced
to file public issues when Private Vulnerability Reporting is not
enabled.

Fixes #2304

Signed-off-by: Solaris-star <820622658@qq.com>

SECURITY.md

@@ -0,0 +1,32 @@
+# Security Policy
+
+## Supported Versions
+
+Security updates are provided for the latest `main` branch and the most recent published releases. Please upgrade when possible.
+
+## Reporting a Vulnerability
+
+**Please do not open a public GitHub issue for security vulnerabilities.**
+
+If you believe you have found a security vulnerability in PrivateGPT, report it privately so maintainers can investigate and remediate before public disclosure.
+
+### Preferred channels
+
+1. **GitHub Private Vulnerability Reporting** (when enabled on this repository): use the **Security** tab → **Report a vulnerability**.
+2. **Discord**: join the [PrivateGPT Discord](https://discord.gg/F8KCFeZbkx) and ask a maintainer for a private channel — do not paste exploit details in public channels.
+3. **X / social**: [@ZylonPrivateGPT](https://twitter.com/ZylonPrivateGPT) can be used only to request a private contact path, not to share technical details.
+
+Please include:
+
+- A description of the issue and its impact
+- Steps to reproduce (or a proof of concept)
+- Affected component(s), versions, and environment details
+- Any suggested remediation if known
+
+### What to expect
+
+- We will acknowledge receipt as soon as possible.
+- We will keep you informed of investigation and remediation progress.
+- Please allow a reasonable window to fix and release a patch before public disclosure.
+
+Thank you for helping keep PrivateGPT and its users safe.