[AXTRACK]

Why

• Provide an explicit private reporting path for vulnerabilities in the public MCP security runner.

Change

• Add SECURITY.md covering supported scope, private vulnerability reporting, security-sensitive areas, scope boundaries, and coordinated disclosure.

Non-goals

• No workflow, harness, dependency, ruleset, permission, or runtime behavior changes.

Validation

• Static review only; documentation change does not alter executable behavior.