Add SECURITY.md with vulnerability reporting policy

Points reporters to the contact form at oai.pm instead of public issues.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

SECURITY.md

@@ -0,0 +1,25 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in oAI, please report it privately rather than opening a public GitHub issue.
+
+To report a security concern, use the contact form at **[https://oai.pm/#contact](https://oai.pm/#contact)**.
+
+Please include as much detail as possible:
+- A description of the vulnerability and its potential impact
+- Steps to reproduce the issue
+- The oAI version and macOS version you're using
+- Any relevant logs (`~/Library/Logs/oAI.log`), with sensitive data redacted
+
+## Scope
+
+oAI is a native macOS app that stores conversations, settings, and API keys locally (SQLite database and Keychain). Areas of particular interest for security reports include:
+- API key handling and Keychain storage
+- MCP file access permission checks
+- Bash execution approval flow
+- Any path that could lead to data exfiltration or unauthorized local file/system access
+
+## Response
+
+Reports submitted through the contact form will be reviewed and acknowledged as soon as possible. Please allow time for a fix to be developed and released before any public disclosure.