Add SECURITY.md and standardize copyright notice

Author: goweft

LICENSE

@@ -187,7 +187,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright [yyyy] [name of copyright owner]
+   Copyright 2026 Steve Gonzalez (goweft)
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.

SECURITY.md

@@ -0,0 +1,13 @@
+# Security
+
+If you discover a security vulnerability in burling, please report it through one of the channels below.
+
+## Reporting
+
+For sensitive issues (anything that could expose users if disclosed publicly), use [GitHub's private vulnerability reporting](https://github.com/goweft/burling/security/advisories/new) to disclose confidentially.
+
+For non-sensitive issues, open a GitHub issue with the `security` label.
+
+## Disclosure
+
+I aim to acknowledge reports within a few days and to keep you updated through remediation. Please allow a reasonable window to address the issue before public disclosure.