docs: add root SECURITY.md for responsible vulnerability disclosure

PRIVACY.md

@@ -77,7 +77,7 @@ We may update this policy occasionally. Changes will be posted here with an upda
 
 ## Contact
 
-For privacy questions, open an issue on GitHub or use the account deletion page above.
+For privacy questions, open an issue on GitHub or use the account deletion page above. For security vulnerability reporting, see [SECURITY.md](SECURITY.md).
 
 ---
 

README.md

@@ -156,9 +156,9 @@ Before publishing a build, run:
 
 Smoke-test startup, profile switching, playback, stream fallback, subtitle/audio switching, IPTV/EPG loading, addon add/remove, search, settings navigation, background sync, and repeated player open/close on the supported device classes.
 
-## Privacy
+## Privacy And Security
 
-See [PRIVACY.md](PRIVACY.md) for the privacy policy. Cloud account and synced data deletion is available at [auth.arvio.tv/delete](https://auth.arvio.tv/delete).
+See [PRIVACY.md](PRIVACY.md) for the privacy policy and [SECURITY.md](SECURITY.md) for responsible security vulnerability reporting. Cloud account and synced data deletion is available at [auth.arvio.tv/delete](https://auth.arvio.tv/delete).
 
 ## License
 

SECURITY.md

@@ -0,0 +1,39 @@
+# Security Policy
+
+This document outlines the policy for reporting security vulnerabilities in ARVIO. Maintainers encourage coordinated disclosure to ensure potential security issues can be investigated and remediated before public discussion.
+
+## Supported Versions
+
+Active application development takes place on the `main` branch.
+
+| Version / Branch | Status |
+| --- | --- |
+| `main` (latest source) | Active development |
+
+Support for tagged releases and previous builds is determined by the maintainers.
+
+## Reporting a Vulnerability
+
+Do **not** report security vulnerabilities through public channels, including:
+
+- Public GitHub issues
+- Public Discord channels
+- Public forums or social media
+
+To disclose a security vulnerability privately, maintainers are establishing a dedicated private reporting channel. Until a private channel (such as GitHub Private Vulnerability Reporting or a designated security contact) is configured for this repository, please refrain from publicly posting technical details, proof-of-concept exploits, or reproduction steps.
+
+## Information to Include
+
+When submitting a security report, include relevant technical context where possible:
+
+- Affected component or platform (e.g., Android application, Web UI, Netlify auth functions, Supabase Edge Functions, or integrations such as Jellyfin, Emby, Plex, Trakt, or IPTV)
+- Version, build number, or git commit hash where the issue was observed
+- Technical description of the vulnerability and its potential security impact
+- Step-by-step reproduction instructions or proof of concept
+- Relevant environment or setup details
+
+Do not include live production credentials, tokens, session keys, or private API keys in a security report.
+
+## Coordinated Disclosure
+
+Maintainers request that security researchers allow reasonable time to investigate, reproduce, and resolve reported findings before technical details are published or disclosed publicly.