docs: create SECURITY.md policy file

SECURITY.md

@@ -0,0 +1,40 @@
+# Security Policy & Implementation Details (Scoinvestigator)
+
+This document outlines the security features, updates, policies, and vulnerability reporting procedures for the Scoinvestigator SaaS platform backend.
+
+## 🛡️ Implemented Security Measures
+
+The following security systems have been integrated into the Scoinvestigator production environment:
+
+### 1. Strict Cross-Origin Resource Sharing (CORS)
+To prevent unauthorized domains from invoking K2 Think backend endpoints:
+- The `ALLOWED_ORIGINS` middleware setting is restricted strictly to authorized production and staging hosts.
+- **Allowed Hosts:**
+  - `https://www.scoinvestigator.com`
+  - `https://scoinvestigator.com`
+  - `https://ai-scientific-coinvestigator-ui.vercel.app` (Staging UI)
+  - `http://localhost:3000` (Local Frontend Development)
+
+### 2. IP-Based Rate Limiting (SlowAPI)
+To protect the AI analysis pipeline from brute-force exploitation and API cost flooding, IP-based request limits are enforced globally:
+- **Authentication & Onboarding:**
+  - `/api/v1/users/login` — Maximum `5 requests per minute` per IP.
+  - `/api/v1/users/register` — Maximum `3 requests per minute` per IP.
+- **AI Processing Engine:**
+  - `/api/v1/analysis/{project_id}` (Core K2 Engine Trigger) — Maximum `2 requests per minute` per IP.
+
+Exceeding these limits triggers an automatic `HTTP 429 Too Many Requests` response.
+
+---
+
+## 🔒 Vulnerability Reporting
+
+If you discover a security vulnerability in this project, please report it immediately:
+- **Contact:** Send an email to [soumanadama93@gmail.com](mailto:soumanadama93@gmail.com).
+- Please do not open public GitHub issues for security vulnerabilities.
+
+---
+
+## 🛠️ Security Configuration Updates
+
+All future security hardening updates (CSP headers, token encryption, database SSL config) should be documented here to maintain a clean production trail.