Responsible disclosure improvements

SECURITY.md

@@ -13,6 +13,90 @@
 | 1.5.x     | :white_check_mark: |
 | 1.6.x     | :white_check_mark: |
 
-## Reporting a Vulnerability
+# Responsible Disclosure Policy
 
-For security issues, kindly email us at security@appwrite.io instead of posting a public issue in GitHub.
+Appwrite welcomes responsible security research and is committed to keeping our users, data, and infrastructure safe.
+
+## Contact
+
+We only accept **Email** reports. Please use this address for all vulnerability reports: security@appwrite.io  
+
+Do **not** open public GitHub issues for security problems.
+
+---
+
+## In Scope
+
+| Category           | Included |
+|--------------------|----------|
+| Production domains | `*.appwrite.io`, `*.appwrite.network`, `*.appwrite.run` |
+| Open-source repos  | Everything under `github.com/appwrite/*` or `github.com/utopia-php/*`|
+| Official SDKs      | All Appwrite-maintained SDKs and demo apps |
+
+---
+
+## Out of Scope
+
+* Third-party integrations
+* Rate-limit or brute-force findings 
+* Self-XSS or clickjacking on static marketing pages
+* Missing SPF, DMARC, or DKIM records without an exploitable impact
+* Vulnerabilities in dependencies with no viable exploit path
+
+---
+
+## Safe Harbor
+
+We will not pursue legal action or law-enforcement involvement for research that:
+
+1. Targets only systems listed as in scope  
+2. Respects user privacy and does not exfiltrate data  
+3. Avoids service degradation or denial of service  
+4. Allows us reasonable time to remediate before public disclosure  
+
+---
+
+## Reporting Format
+
+Include the following for fastest triage:
+
+* Clear title and summary of the issue
+* Step-by-step reproduction or proof-of-concept
+* Impact assessment
+* Affected endpoint, repo, or component
+* Suggested remediation if known
+
+Screenshots and detailed logs are appreciated.
+
+---
+
+## Recognition
+
+Appwrite currently offers non-monetary recognition.
+
+Discretionary swag bounties may be awarded when budget allows but are not guaranteed.
+
+---
+
+## Duplicate Handling
+
+First valid report gets credit. Later duplicates are closed as duplicates.
+
+---
+
+## Public Disclosure
+
+Please wait until either the fix is live or 90 days have passed since our acknowledgment, whichever comes first, before publishing details. Extensions can be arranged by mutual agreement.
+
+---
+
+## Prohibited Actions
+
+* Social engineering Appwrite core team or customers
+* Physical attacks on offices or data centers
+* Volumetric denial of service
+* Automated scanning that degrades service for other users
+
+---
+
+Thank you for helping keep Appwrite secure.