📦 deps(thirdparty): update snapshots

ui-ux-pro-max/SECURITY.md

@@ -0,0 +1,35 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest released version of `ui-ux-pro-max-cli` and the latest `main` branch of this skill receive security fixes.
+
+| Version | Supported |
+|---------|-----------|
+| Latest release | ✅ |
+| Older releases | ❌ |
+
+## Reporting a Vulnerability
+
+Please **do not** open a public GitHub issue for security vulnerabilities.
+
+Instead, report it privately using [GitHub's private vulnerability reporting](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/security/advisories/new) (Security tab → "Report a vulnerability").
+
+Include as much of the following as possible:
+
+- A description of the vulnerability and its potential impact
+- Steps to reproduce (command, prompt, or CLI flags used)
+- The version of `ui-ux-pro-max-cli` and the AI assistant/platform involved
+- Any relevant logs or output
+
+We aim to acknowledge reports within 5 business days and to provide a fix or mitigation timeline within 14 days for confirmed issues.
+
+## Scope
+
+This project is a design-system generation skill: a Python search/CLI tool and static data (CSV/JSON) consumed by AI coding assistants. In-scope concerns include:
+
+- Arbitrary code execution via the CLI installer or search scripts
+- Path traversal or unsafe file writes when running `uipro init` / `uipro uninstall`
+- Supply-chain issues in the `ui-ux-pro-max-cli` npm package or its release pipeline
+
+Out of scope: the design output itself (colors, fonts, UI recommendations) is not a security surface.