docs: add a security policy - #987

Motivation

This repository has no SECURITY.md, and neither does any other public ProjectOpenSea repo. A researcher who finds something here has nothing in the repo to follow, so the report lands as a public issue. That already happened in a sibling repo: ProjectOpenSea/tool-sdk#14 opens by saying it was filed publicly because private vulnerability reporting is off and there is no SECURITY.md. That reporter also reasoned about the Bugcrowd brief and its exclusions, so the program is not the missing piece. The signposting is.

This matters more here than in most of the org's repos, because seaport-js moves assets. It builds order structs, produces the EIP-712 payload a wallet signs, runs the balance and approval checks, and assembles the fulfillment calldata. A bug in any of that decides what a user is asked to sign and what their transaction does.

Solution

SECURITY.md at the repo root, plus a Security section in the README and a matching table-of-contents entry. Both point to OpenSea's Bugcrowd program at https://bugcrowd.com/engagements/opensea.

The file links the Bugcrowd brief as the authority on scope, exclusions, severity, and rewards rather than restating any of it, so this copy cannot drift out of step with the program. What it does carry:

• Where to report, stated first, with no competing channel.
• What this library is and where its risk sits, including a note that Seaport the protocol lives in another repository.
• A "please do not" list: no exploit attempts against opensea.io, api.opensea.io, or any other OpenSea-operated service, no automated scanners or fuzzers pointed at production, no touching accounts or data that are not yours, no denial of service or social engineering.

Response and disclosure timelines are left to the program rather than promised here.

Manual follow-up for a human

1. Confirm https://bugcrowd.com/engagements/opensea is the right destination for this repo, and that the brief's scope covers marketplace client library code and not only the opensea.io web surface. The whole file hangs off that link, so it is worth one look. If the brief scopes this code out, the link sends researchers somewhere that will turn them away.
2. Optionally enable GitHub private vulnerability reporting (Settings, Code security) as a secondary path for repo-specific issues. It is off today. The file does not mention it, deliberately, since Bugcrowd is the channel that gets triaged. Enabling it does add a "Report a vulnerability" button to the Security tab, which is another place a researcher looks before giving up and filing publicly.

Verification

Documentation only, no source changed. Biome here is configured for **/*.ts, **/*.js, and **/*.json, so markdown is outside format and lint.

Run in a fresh worktree, exit codes captured rather than eyeballed: