Add a security policy documentation file to MuseScore

[alexadd1s]

Resolves: #34343

As of right now, MuseScore does not have a dedicated file describing its security policies. The addition of this file would be beneficial to both users and developers of MuseScore and provide some peace of mind. This PR is not meant to resolve this issue once and for all, but to introduce this feature to MuseScore's GitHub repository and make it available for changes and updates.

• I signed the CLA as EuphPlayer808
• The title of the PR describes the problem it addresses.
• Each commit's message describes its purpose and effects, and references the issue it resolves. If changes are extensive, there is a sequence of easily reviewable commits.
• The code in the PR follows the coding rules.
• I understand all aspects of the code I'm contributing and I'm able to explain it if requested.
• The code compiles and runs on my machine, preferably after each commit individually. I have manually tested and verified that my changes fulfil their intended purpose.
• No prior attempts to resolve this problem exist, or if they do, I listed them in my PR description and described how I avoided repeating past mistakes.
• There are no unnecessary changes.
• [N/A] I created a unit test or vtest to verify the changes I made (if applicable).

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 07e31a2e-8681-45d5-86d6-f561b0759a00

📥 Commits

Reviewing files that changed from the base of the PR and between 42a683c and 6ebc4e3.

📒 Files selected for processing (1)

• SECURITY.md

🚧 Files skipped from review as they are similar to previous changes (1)

• SECURITY.md

---

📝 Walkthrough

Walkthrough

Added SECURITY.md with guidance to use the latest MuseScore Studio version. The document defines an email-based vulnerability reporting process and lists the required report information.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the primary change: adding a security policy file to MuseScore.
Description check	✅ Passed	The description includes the issue reference, motivation, checklist, and an appropriate not-applicable test entry.
Linked Issues check	✅ Passed	The changes satisfy issue #34343 by adding SECURITY.md with security recommendations and vulnerability reporting instructions.
Out of Scope Changes check	✅ Passed	The pull request changes only SECURITY.md, which directly supports the linked issue objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Review ran into problems

🔥 Problems

Linked repositories: Public OSS repositories can only analyze public repositories installed in this organization. No linked repositories were analyzed; skipped musescore/muse_framework.git.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

SECURITY.md (1)

8-8: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Request the affected version and environment.

Add the MuseScore Studio version or build, operating system, and relevant configuration to the required report information. These details support reproduction and impact assessment.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@SECURITY.md` at line 8, Update the security report requirements in
SECURITY.md to request the affected MuseScore Studio version or build, operating
system, and relevant configuration alongside the existing vulnerability details,
reproduction steps, and impact or exploit information.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@SECURITY.md`:
- Line 3: Correct the spelling errors in SECURITY.md by changing “verion” to
“version” and “vulnereability” to “vulnerability,” without altering the
surrounding security guidance.

---

Nitpick comments:
In `@SECURITY.md`:
- Line 8: Update the security report requirements in SECURITY.md to request the
affected MuseScore Studio version or build, operating system, and relevant
configuration alongside the existing vulnerability details, reproduction steps,
and impact or exploit information.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b726305f-4d11-4725-aa14-6536bed007c8

📥 Commits

Reviewing files that changed from the base of the PR and between c1ad658 and 42a683c.

📒 Files selected for processing (1)

• SECURITY.md