docs: expand SECURITY.md for GitHub security policy

Author: false200

SECURITY.md

@@ -2,21 +2,48 @@
 
 ## Supported Versions
 
-| Version | Supported |
-| ------- | --------- |
-| 0.1.x   | Yes       |
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.1.x   | :white_check_mark: |
+| < 0.1   | :x:                |
 
 ## Reporting a Vulnerability
 
-Please **do not** open a public GitHub issue for security vulnerabilities.
+**Do not** open a public GitHub issue for security vulnerabilities.
 
-Report them privately by opening a [GitHub Security Advisory](https://github.com/false200/Tooltrim/security/advisories/new) or emailing the maintainer via their GitHub profile contact.
+Report privately using one of these:
 
-Include:
+1. [GitHub Security Advisories](https://github.com/false200/Tooltrim/security/advisories/new) (preferred)
+2. Contact the maintainer through their [GitHub profile](https://github.com/false200)
 
-- A description of the issue
+## What to Include
+
+- Description of the vulnerability
 - Steps to reproduce
-- Potential impact
-- Suggested fix (if any)
+- Affected versions
+- Potential impact (e.g. credential leak, arbitrary code execution)
+- Suggested fix or mitigation, if you have one
+
+## Response Timeline
+
+| Step              | Target        |
+| ----------------- | ------------- |
+| Acknowledgement   | 72 hours      |
+| Status update     | 7 days        |
+| Fix or mitigation | Best effort   |
+
+## Scope
+
+In scope:
+
+- The `tooltrim` npm package and CLI
+- This repository's source code
+- Default configuration and documented deployment patterns
+
+Out of scope:
+
+- Vulnerabilities in upstream MCP servers you connect via config
+- Misconfiguration of secrets in user-owned `tooltrim.config.yaml` files
+- Issues in third-party dependencies (report those to the upstream project; we will bump deps when fixes are available)
 
-We aim to acknowledge reports within 72 hours.
+Thank you for helping keep Tooltrim and its users safe.