Add SECURITY.md file

SECURITY.md

@@ -0,0 +1,39 @@
+# Security Policy
+
+## Reporting Security Vulnerabilities
+
+The U.S. Food and Drug Administration (FDA) takes security vulnerabilities seriously. If you believe you have found a security vulnerability in this repository, please report it to us through coordinated disclosure.
+
+**Please do NOT report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
+
+---
+
+## How to Report
+
+FDA follows the HHS Vulnerability Disclosure Policy. Submit your report through the official HHS reporting portal:
+
+- **HHS Vulnerability Disclosure Policy:** [https://www.hhs.gov/vulnerability-disclosure-policy/index.html]
+- **Submit a Report:** [https://hhs.responsibledisclosure.com]
+
+### Contact
+
+For general security questions or concerns about FDA systems, contact:
+- **Repository Maintainer:** precisionfda@fda.hhs.gov
+
+---
+## Security Best Practices for Contributors
+
+When contributing to this repository:
+
+- Follow the principle of least privilege
+- Validate and sanitize all inputs
+- Use parameterized queries for database access
+- Keep dependencies up to date
+- Never commit secrets, API keys, or credentials
+- Review security advisories for dependencies
+
+---
+
+**Disclaimer:** This repository contains code developed for research, regulatory science, or public health purposes. The code is provided "as-is" without warranty. Use in production systems should follow your organization's security assessment processes.
+
+**Last Updated:** June 09, 2026