docs(security): link the vulnerability disclosure program in SECURITY.md

[posthog]

Problem

• An external researcher who followed our published policy was sent down an email-only path, got bounced by the auto-reply, and escalated to our infrastructure provider instead — their vulnerability is still undisclosed.
• This org SECURITY.md is the default security policy GitHub serves on every PostHog repository that has no copy of its own, so it is the intake instruction most external researchers read.
• It named a "vulnerability disclosure program" but never linked it and gave only email intake. Commit 8f8da2f introduced the gap when it rewrote the intake text.
• posthog.com/SECURITY.md, the handbook security page, and the advisories page all publish two paths and link the Bugcrowd VDP. The org file did not, so the two disagreed.

Changes

• Align the "Reporting a Vulnerability" text with the wording already live on posthog.com: both paths, Bugcrowd linked up front.

-Please report security vulnerabilities to security-reports@posthog.com.
-
-We currently operate a vulnerability disclosure program and reward valid, high quality reports with merch.
+Security vulnerabilities and other security related findings can be reported through our [vulnerability disclosure program](https://bugcrowd.com/engagements/posthog-vdp-pro) or by email to [security-reports@posthog.com](mailto:security-reports@posthog.com).
+
+We do not operate a bug bounty program, but we reward valid, actionable reports with merch.

Open question for review

• security-reports@ or security@ is canonical? The PGP key and the auto-reply use security@, while the docs use security-reports@. This PR keeps security-reports@ to match the live docs, but the canonical address is a policy call, not a doc fix. (Same discrepancy flagged in #70.)

Out of scope for this repo

The report also names static/.well-known/security.txt, which reinforces the email-only first step and is missing the Expires: field RFC 9116 requires. That file lives in PostHog/posthog.com, not here, so it needs a separate PR there. #70 flags the same file.

Agent context

• This branch may need a rebase on #70, which also edits SECURITY.md. The two edits touch different sections (intake text vs. a new revocation section), so no textual conflict is expected.

---

Created with PostHog Desktop from this inbox report.

[posthog]

🦔 PostHog Review reviewed this pull request

Nothing worth raising this time, so here's a calming picture instead: