Add SECURITY.md and QC Preflight Checks workflow

.github/workflows/qcom-preflight-checks.yml

@@ -0,0 +1,24 @@
+name: QC Preflight Checks
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  preflight:
+    name: Run QC Preflight Checks
+    uses: qualcomm/qcom-reusable-workflows/.github/workflows/reusable-qcom-preflight-checks-orchestrator.yml@v2
+    with:
+      enable-semgrep-scan: true
+      enable-dependency-review: true
+      enable-repolinter-check: true
+      enable-copyright-license-check: true
+      enable-commit-email-check: true
+      enable-commit-msg-check: false
+      enable-armor-checkers: false
+
+    permissions:
+      contents: read
+      security-events: write

SECURITY.md

@@ -0,0 +1,31 @@
+How to Report a Potential Vulnerability?
+========================================
+
+If you would like to report a public issue (for example, one with a released
+CVE number), please report it as a
+[GitHub issue](https://github.com/qualcomm/REPLACE-ME/issues/new).
+If you have a patch ready, submit it following the same procedure as any
+other patch as described in [CONTRIBUTING.md](CONTRIBUTING.md).
+
+If you are dealing with a not-yet released or urgent issue, please contact us
+via our [Product Security team](mailto:product-security@qualcomm.com) or
+see our
+[Report a Bug](https://www.qualcomm.com/company/product-security/report-a-bug)
+page. Please include the following details while reporting a vulnerability:
+- Description of the vulnerability
+- Steps to reproduce
+- Affected versions
+- Potential impact
+- Any relevant logs or screenshots
+
+## Coordinated Disclosure
+
+We follow a Coordinated Vulnerability Disclosure (CVD) process:
+
+- **Initial Response**: We will acknowledge your report within 48 hours.
+
+- **Investigation**: Our team will investigate the issue and provide updates.
+
+- **Resolution**: We will work with you to resolve the issue and prepare a fix.
+
+- **Disclosure**: Once the fix is ready, we will disclose the vulnerability and notify affected users.