Context: Content SDK currently has no `SECURITY.md` file. Three CVEs affecting the React/Next.js stack have been disclosed in the past 6 months, two of which are actively exploited. Content SDK's peer dependency ranges technically permit vulnerable versions. A security policy document provides a single authoritative reference for consumers to check minimum safe versions.
Steps:
1. Create `SECURITY.md` at repo root
2. Include: vulnerability reporting process, minimum supported framework versions for security, a table of relevant CVEs with affected and fixed versions
3. Reference this file from `README.md` and from `create-content-sdk-app` post-scaffold output
4. Add a CI check that warns if peer dependency floors fall below documented security minimums
Acceptance criteria:
`SECURITY.md` exists at repo root with CVE table and minimum version guidance
README links to SECURITY.md
`create-content-sdk-app` output mentions checking SECURITY.md
Risks: None identified.