chore: refresh GitHub repository setup (#23)

* chore: refresh GitHub repository setup

* chore: align CI with Rust 1.88 MSRV

SECURITY.md

@@ -0,0 +1,42 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| latest  | Yes       |
+| < latest | No (upgrade to latest) |
+
+## Reporting a Vulnerability
+
+**Please do NOT report security vulnerabilities through public GitHub issues.**
+
+Instead, use [GitHub Security Advisories](https://github.com/srothgan/tui-textarea/security/advisories/new)
+to report vulnerabilities privately.
+
+Please include:
+
+1. Description of the vulnerability
+2. Steps to reproduce
+3. Potential impact
+4. Suggested fix, if any
+
+## Response Timeline
+
+- **Acknowledgment**: Within 48 hours
+- **Initial assessment**: Within 1 week
+- **Fix and disclosure**: Coordinated with reporter, typically within 30 days
+
+## Scope
+
+This policy covers the `tui-textarea-2` crate and vulnerabilities in its integration
+with supported terminal backends and optional features. Vulnerabilities in upstream
+libraries such as Ratatui, Crossterm, Termion, or Termwiz should be reported to
+their respective maintainers unless the issue is caused by this crate's usage or
+integration of those libraries.
+
+## Security Measures
+
+- Dependency updates are managed via Dependabot
+- Dependabot security alerts and security updates are enabled
+- All PRs require CI checks for test, clippy, fmt, and MSRV compatibility