docs(security): extend security policy (#1142)

* docs(security): extend security policy

Signed-off-by: Josef Andersson <[email protected]>

* style: tweak security reporting docs

---------

Signed-off-by: Josef Andersson <[email protected]>
Co-authored-by: Orhun Parmaksız <[email protected]>

SECURITY.md

@@ -1,4 +1,6 @@
-# Security Policy
+# Security
+
+If you wish to report a security vulnerability privately, we appreciate your diligence. Please follow the guidelines below to submit your report.
 
 ## Supported Versions
 
@@ -11,6 +13,30 @@ The following versions are supported with security updates:
 | 1.0.x   | :x:                |
 | < 0.1.0 | :x:                |
 
-## Reporting a Vulnerability
+## Reporting
 
-Please use the [GitHub Security Advisories](https://github.com/orhun/git-cliff/security/advisories/new) feature to report vulnerabilities.
+To report a security vulnerability, please provide the following information:
+
+1. **PUBLIC**
+
+   - Indicate whether this vulnerability has already been publicly discussed or disclosed.
+   - If so, provide relevant links.
+
+2. **DESCRIPTION**
+   - Provide a detailed description of the security vulnerability.
+   - Include as much information as possible to help us understand and address the issue.
+
+Send this information, along with any additional relevant details, to <orhunparmaksiz@gmail.com>.
+
+## Confidentiality
+
+We kindly ask you to keep the report confidential until a public announcement is made.
+
+## Notes
+
+- Vulnerabilities will be handled on a best-effort basis.
+- You may request an advance copy of the patched release, but we cannot guarantee early access before the public release.
+- You will be notified via email simultaneously with the public announcement.
+- We will respond within a few weeks to confirm whether your report has been accepted or rejected.
+
+Thank you for helping to improve the security of **git-cliff**! ⛰️