Updated the security policy to include a section on reporting vulnerabilities and guidelines for responsible disclosure.