docs: Add SECURITY.md

[mc-nv]

What does the PR do?

• Adds SECURITY.md: NVIDIA PSIRT reporting channels, architecture context, threat model and security assumptions for this repo.

Checklist

• PR title reflects the change and is of format <commit_type>: <Title>
• Changes are described in the pull request.
• Related issues are referenced.
• Populated github labels field
• Added test plan and verified test passes.
• Verified that the PR passes existing CI.
• Verified copyright is correct on all changed files.
• Added succinct git squash message before merging ref.
• All template sections are filled out.
• Optional: Additional screenshots for behavior/output changes with before/after.

Commit Type:

Check the conventional commit type
box here and add the label to the github PR.

• build
• ci
• docs
• feat
• fix
• perf
• refactor
• revert
• style
• test

Related PRs:

• Same change in other repos; tracked on TRI-1935.

Where should the reviewer start?

• SECURITY.md: threat model and assumptions sections.

Test plan:

• Docs only; pre-commit hooks (license header, codespell) passed.

• CI Pipeline ID:

Caveats:

• Threat model is drawn from the code; treat as a draft for review.

Related Issues: (use one of the action keywords Closes / Fixes / Resolves / Relates to)

• Resolves: TRI-1935

[greptile-apps]

Confidence Score: 5/5

[Low risk] Adds security policy documentation.

The PR appears safe to merge, though restoring the checkpoint-loading warning would make the security guidance more useful.

Findings

1.   Checkpoint loading warning removed ▶

Summary

The PR adds a security policy with NVIDIA vulnerability-reporting channels and a condensed threat model for the tutorials.

• The condensed model retains general supply-chain guidance but drops the specific warning about loading externally downloaded checkpoints.

_{Reviews (3) · Last reviewed commit: "docs: Simplify SECURITY.md"}

[greptile-apps]

Checkpoint loading warning removed The revised threat model no longer explains that loading an untrusted model checkpoint can execute code. The Part 1 and Part 5 tutorials download a .pth file from Dropbox and load it with torch.load, but their guides do not warn about this risk. The generic tampering warning may leave readers unaware that they should verify the checkpoint’s provenance before running the export step. How this was verified: The tutorial download commands feed an external checkpoint to torch.load, and the revised policy omits the prior load-time execution warning.