Add SECURITY.md for responsible disclosure and fraud reporting

[Copilot]

No security policy existed for reporting fraudulent listings or tooling vulnerabilities — a gap for a registry consumed directly by wallets and end-user apps.

Adds SECURITY.md covering:

• Scope — fraudulent/impersonating asset listings vs. tooling vulnerabilities (scripts, CI workflows)
• Reporting paths — separate flows for listing fraud (48h SLA) and tooling CVEs (72h ack, responsible disclosure)
• PR safety guidelines — consolidates existing rules (no ton.api image links, no editing auto-generated .json files, no impersonation)
• Fee scam reminder — mirrors the warning already in the PR template; Tonkeeper never charges for verification

Please make sure you change the original .yaml fields in the accounts/, collections/ or jettons/ directories and leave the auto-generated .json files in the repository root alone. Also please make sure that you do not use ton.api links in your pull request.
Example pull request:

address: Address of your token 
symbol: Symbol of your token
websites:
  - "link"
social:
  - "link"

ATTENTION! The Tonkeeper team does not charge any fees for checking/verifying tokens/collections. The procedure is ABSOLUTELY FREE. Ignore comments in commits that require payment to speed up/successfully check the PR. Stay safe fren!

Пожалуйста, убедитесь, что вы изменили исходные поля .yaml в каталогах account/, Collections/ или jettons/ и не трогаете автоматически сгенерированные файлы .json в корне репозитория. Так же, пожалуйста, убедитесь, что вы не используете ссылки ton.api в вашем пул реквесте.
Пример пул реквеста:

address: Адрес вашего токена 
symbol: Сивол вашего токена
websites:
  - "ссылка"
social:
  - "ссылка"

ВНИМАНИЕ! Команда Tonkeeper не берет никакой оплаты за проверку/верификацию токенов/коллекций. Процедура АБСОЛЮТНО БЕСПЛАТНА. Игнорируйте комментарии в коммитах, требующих оплаты для ускорения/успешности проверки. Будьте внимательны и осторожны!

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Lawrence Lucas Large (LukeLarge)]

Add SECURITY.md for responsible disclosure and fraud reporting
#3

[Copilot]

Pull request overview

This PR adds a comprehensive SECURITY.md file to establish a formal security policy for the ton-assets repository, which is a community-curated registry of TON blockchain assets used by wallets and applications. The policy addresses a critical gap in responsible disclosure procedures for both fraudulent asset listings and tooling vulnerabilities.

Changes:

• Introduces SECURITY.md with two-track reporting: fraudulent listings (48h SLA) and tooling vulnerabilities (72h acknowledgment)
• Consolidates existing PR safety guidelines from the README and PR template into the security policy
• Emphasizes that Tonkeeper verification is free and warns against payment scam requests

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.