docs: add an org-wide security policy

[DerekCorniello]

Why

The org .github repo has a code of conduct and a contributing guide but no security policy, so no muxlang repo advertised how to report a vulnerability. As an org-wide community-health file it applies to every repo that lacks its own.

What

Adds SECURITY.md that:

• directs reporters to GitHub private vulnerability reporting (the Security tab "Report a vulnerability" flow, supported on these repos), with a private maintainer fallback - no unverified email address invented
• states the alpha support window (latest release only)
• calls out the untrusted-code scope that matters most here: playground sandbox escapes, compiler/runtime memory safety reachable from valid Mux input, and vulnerable shipped dependencies

🤖 Generated with Claude Code

https://claude.ai/code/session_01NN6tAVpzkn8ZwE7M3hfyQk

[greptile-apps]

Greptile Summary

This PR adds an org-wide SECURITY.md to the muxlang .github repository, which GitHub automatically surfaces as the security policy for every repo in the organization that lacks its own.

• The policy directs reporters to GitHub's built-in private vulnerability reporting flow as the primary channel, with a named individual as a private fallback, and explicitly warns against public disclosure in issues or PRs.
• It documents a 90-day fix-and-publish commitment, an alpha support window (latest release only), and a focused scope covering playground sandbox escapes, compiler/runtime memory-safety issues, and vulnerable shipped dependencies.

Confidence Score: 5/5

Safe to merge — adds a documentation-only file with no code changes

The change is a single new Markdown file with no executable code. The policy content is coherent: it uses GitHub's native private advisory flow as the primary channel, states a 90-day disclosure window, scopes the most relevant security surfaces (sandbox escapes, memory-safety, vulnerable dependencies), and is clear about the alpha support model. No functional behavior is affected.

No files require special attention

Important Files Changed

Filename	Overview
SECURITY.md	New org-wide security policy covering reporting via GitHub private vulnerability reporting, alpha support window, 90-day disclosure commitment, and playground/compiler scope — well-structured and complete

_{Reviews (2): Last reviewed commit: "docs: add a disclosure timeline and clar..." | Re-trigger Greptile}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud