security: replace personal email with confidential issue reporting

SECURITY.md

@@ -1 +1,21 @@
-If you find a security issue, report it privately by emailing blankie@tuta.com. Please don't file a public issue.
+# Security Policy
+
+TinyWeb Forum is a trust-gated, gossip-based forum plugin. Moderation is
+distributed — block lists can be manipulated by malicious peers.
+
+## Supported Versions
+
+Security fixes are handled on the default branch.
+
+## Deployment Guidance
+
+- Keep TinyWeb bound to `127.0.0.1` unless you need LAN access
+- If binding to `0.0.0.0`, put a reverse proxy with auth in front (Caddy, nginx)
+- Always use HTTPS when exposing beyond localhost
+- Never commit `*.db`, `.env`, or `models/` to version control
+- Forum trust is gossip-based: only subscribe to peers you trust
+
+## Reporting
+
+Report vulnerabilities privately by creating a confidential issue on the
+repository. Do not file a public issue until the report has been acknowledged.