Add Security.md to the repository

[davelebbing]

Use a Security.md file to communicate any security issues in the event that any are later discovered. Coordinate this with a knowledge base publication with similar information.

Below is proposed content that could be used for this. Current conventions for Security.md are to put this file either in the repository root, in a docs folder, or in a .github folder.

# Security Policy

## Overview
XCreds handles sensitive user information, local Mac passwords, and cloud Identity Provider (IdP) authentication tokens. Because it operates as a macOS Security Agent mechanism, maintaining high security is our priority.

## Supported Versions

We actively support the current major version of XCreds. Bugs found in older versions should be verified against the latest release before reporting.

| Version | Supported | Notes |
| ------- | --------- | ----- |
| 5.x / 6.x | ✅ Supported | Active development and security patches. |
| <= 4.x   | ❌ Unsupported | Please upgrade to the latest stable release. |

## Reporting a Vulnerability

**Please do not report security vulnerabilities through public GitHub issues.**

If you discover a security flaw or vulnerability affecting XCreds, please report it privately:

1. **Email:** Send a detailed report to `support@twocanoes.com`.
2. **Details to include:**
   * A description of the vulnerability.
   * Step-by-step instructions or proof-of-concept (PoC) code to reproduce it.
   * The version of XCreds and macOS used during testing.
   * Impact analysis (e.g., local privilege escalation, token exposure).

We will acknowledge receipt of your vulnerability report within 3 business days and work to provide a timely fix.

## Our Security Commitments

* **Encryption:** XCreds relies on built-in macOS TLS for network communication and stores credentials securely using AES-256 encryption in the user's login keychain.
* **Privilege Separation:** Code execution handles security agent tasks with minimal required scope to prevent privilege escalation.
* **Coordinated Disclosure:** We ask that you give us reasonable time to fix the issue before public disclosure, and we will credit you for your discovery if requested.