Add SECURITY.md for vulnerability reporting

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## CRA Stewardship
+
+This project is supported under the Linux Foundation CRA stewardship framework, as described at https://www.linuxfoundation.org/security. Security vulnerabilities should be reported through the mechanisms described below, which we will coordinate with our CRA steward. For actively exploited vulnerabilities and severe incidents that may require CRA escalation, please use the project’s emergency security reporting mechanisms as appropriate.
+
+## Reporting a Vulnerability
+
+We take the security of this project seriously. If you believe you have found a security vulnerability, please do not report it publicly through a GitHub issue.
+
+Instead, please send a confidential email with details of the vulnerability and a reference to this tool-java repository to:
+[spdx-tools-security@lists.spdx.org](mailto:spdx-tools-security@lists.spdx.org)
+
+### What to Include
+
+To help us quickly understand and address the issue, please include as much of the following information as possible:
+
+* Type of issue (e.g., buffer overflow)
+* Full paths of source file(s) related to the manifestation of the issue
+* Any special configuration required to reproduce the issue
+* Step-by-step instructions or a proof-of-concept to reproduce the issue
+* Impact of the issue, including how an attacker could exploit it
+
+### Response & Handling Process
+
+* **Acknowledgment:** We will acknowledge receipt of your vulnerability report within a reasonable timeframe.
+* **Investigation:** The maintainers will investigate the issue and determine its impact and scope.
+* **Fix & Disclosure:** Once a fix is prepared and tested, a security update will be released. We appreciate your cooperation in keeping the vulnerability confidential until a patch is publicly available.