docs(security): align org-default policy with the real disclosure process

SECURITY.md

@@ -10,11 +10,21 @@ live in one place:
 
 Please do **not** open a public issue for security reports.
 
-Instead, use GitHub's private vulnerability reporting on the affected repository
-(the **Security** tab → **Report a vulnerability**), or follow the disclosure
-instructions in the [nimbus-security](https://github.com/nimbus-agent/nimbus-security)
-repository.
-
-We aim to acknowledge reports within a few business days and will coordinate a
-fix and a disclosure timeline with you. Thank you for helping keep Nimbus and
-its users safe.
+Use GitHub's private vulnerability reporting on the affected repository: its
+**Security** tab → **Report a vulnerability**. This is the only reporting
+channel — Nimbus publishes no security email address and no PGP key, because a
+solo maintainer's unmonitored inbox drops reports silently. Filing requires a
+free GitHub account.
+
+If you are not sure which repository is affected, report it against
+[Nimbus](https://github.com/nimbus-agent/Nimbus/security/advisories/new) and we
+will move it.
+
+Nimbus is maintained by one person as a side project, so there is no guaranteed
+response time and no SLA. Reports are typically read within a week and
+prioritised by severity, and we will agree a coordinated-disclosure timeline
+with you rather than sitting on a report. There is no bug-bounty programme.
+
+Full policy, scope and safe-harbor terms:
+[nimbus-security/SECURITY.md](https://github.com/nimbus-agent/nimbus-security/blob/main/SECURITY.md).
+Thank you for helping keep Nimbus and its users safe.