Add a security policy pointing at the Cantina bounty

SECURITY.md

@@ -0,0 +1,35 @@
+# Mezo Security Policy
+
+**Please do not file a public ticket mentioning the vulnerability.**
+
+We will work with researchers to coordinate vulnerability disclosure between
+our stakers, partners, and users to ensure the successful mitigation of
+vulnerabilities. Throughout the reporting process, we expect researchers to
+honor an embargo period that may vary depending on the severity of the
+disclosure. This ensures that we have the opportunity to fix any issues,
+identify further issues (if any), and inform our users.
+
+## Bug Bounty
+
+Mezo runs a bug bounty program on Cantina:
+https://cantina.xyz/bounties/82d15510-9264-4ce0-9bee-ee0cb5c53742 . The MUSD
+smart contracts are in scope. Findings in scope for the bounty must be
+submitted through Cantina to be eligible for a reward; see the program page
+for scope, rules, and reward tiers.
+
+## Direct Reports
+
+_Due to the vulnerability reporting volume in the age of LLM agents,
+vulnerabilities reported through `security@mezo.org` may be subject to **no
+response** unless they present a high-severity, highly exploitable, time
+sensitive issue._ Other reports should flow through the Cantina bounty program.
+
+For such issues, email `security@mezo.org`, following the guidelines at
+https://mezo.org/SECURITY.md . Encryption keys are listed at
+https://mezo.org/security.txt .
+
+The Mezo team will make a best effort to respond to high-severity, highly
+exploitable, time sensitive reports **within 24 hours**. If a report is within
+the scope of the bounty program and does not meet the above criteria, a best
+effort will be made to notify the reporter that they should submit via the
+Cantina program.