docs: support nostream 3.5+ only and name a private reporting route

.changeset/security-policy.md

@@ -0,0 +1,2 @@
+---
+---

SECURITY.md

@@ -2,18 +2,25 @@
 
 ## Supported Versions
 
-Use this section to tell people about which versions of your project are
-currently being supported with security updates.
+Security fixes land on **nostream 3.5 and newer** only. The current release line is 3.6.x (3.6.1 at the time of writing).
 
-| Version   | Supported          |
-| --------- | ------------------ |
-| > 1.11.x  | :white_check_mark: |
-| < 1.9.0   | :x:                |
+| Version         | Supported          |
+| --------------- | ------------------ |
+| 3.5.x and newer | :white_check_mark: |
+| 3.0.x – 3.4.x   | :x:                |
+| 2.x             | :x:                |
+| 1.x             | :x:                |
+
+Unsupported lines receive no advisories, backports or patches. If you run one of them, upgrade to a supported version before reporting.
+
+The Rust rewrite (`rewrite/main`) does not ship a release yet. It is covered by this policy as it ships.
 
 ## Reporting a Vulnerability
 
-Use this section to tell people how to report a vulnerability.
+Please do not open a public issue for a security problem. Report it privately through GitHub's private vulnerability reporting:
+
+<https://github.com/cameri/nostream/security/advisories/new>
+
+Include the affected version, how your deployment is configured, and steps to reproduce.
 
-Tell them where to go, how often they can expect to get an update on a
-reported vulnerability, what to expect if the vulnerability is accepted or
-declined, etc.
+You can expect a first response within 7 days. After that, we will keep you updated on the progress of the report. If the report is accepted, we will work on a fix and publish a security advisory once a patched release is available. If it is declined, we will explain why.