docs(readme): surface the security policy from the README

[MegaRedHand]

🗒️ Description / Motivation

Aligns ethlambda with ethrex's security policy setup.

.github/SECURITY.md already exists here and is byte-identical to ethrex's (modulo two trailing-whitespace differences, which ours does not have), so no changes were needed to the policy itself. What was missing is ethrex's README pointer to it: the policy was only reachable through GitHub's Security tab, so anyone reading the repo front page had no idea where to report a vulnerability.

What Changed

• README.md: new ## Security section, placed just before ## Contributing to match ethrex's ordering. Text is copied from ethrex's README section verbatim, including the repo-relative ../../security/advisories/new advisory link (which resolves correctly under this repo) and the security@lambdaclass.com fallback.

Correctness / Behavior Guarantees

Docs only. No code, config, or build changes.

Tests Added / Run

None; documentation-only change. Verified the two new links resolve:

• ./.github/SECURITY.md exists in-tree.
• ../../security/advisories/new is the same relative form ethrex uses, resolving to https://github.com/lambdaclass/ethlambda/security/advisories/new.

Related Issues / PRs

• Related to lambdaclass/ethrex .github/SECURITY.md

✅ Verification Checklist

• Ran make fmt — clean
• Ran make lint (clippy with -D warnings) — clean
• Ran make test (cargo test --workspace --profile release-fast) — all passing

(Not run: no Rust sources touched.)

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[github-actions]

🤖 Kimi Code Review

This is a documentation-only change adding security disclosure channels. No consensus-critical code is modified.

README.md

1. Verify referenced assets exist: Ensure ./.github/SECURITY.md actually exists in the repository (Item 1 references it). If this PR doesn't include that file, add it or update the link.

2. Link verification: The relative link ../../security/advisories/new correctly resolves to the GitHub Security tab from the repository root.

3. Suggestion for hardening: Consider adding a GPG key fingerprint for encrypted vulnerability reports alongside the email (optional but recommended for consensus clients handling sensitive cryptographic vulnerabilities).

4. Email verification: Confirm security@lambdaclass.com is actively monitored with a defined SLA for initial response (critical for blockchain clients where vulnerabilities can affect mainnet).

The change follows standard responsible disclosure practices and is appropriate for a consensus client. No blockers.

---

Automated review by Kimi (Moonshot AI) · kimi-k2.5 · custom prompt

[github-actions]

🤖 Claude Code Review

This PR is documentation-only (README.md addition), so the consensus-layer/code-correctness checklist doesn't apply. A quick review of the change itself:

Review

Content is accurate and low-risk.

• .github/SECURITY.md exists in this repo (confirmed), so the "Security Policy" link at the new line resolves correctly.
• The relative link ../../security/advisories/new resolves properly on GitHub's rendered README (relative to the repo root's implicit path), pointing to the repo's security advisories page — this matches the pattern used by other lambdaclass repos.
• Placement between the community section and ## Contributing reads naturally and matches the stated goal of mirroring ethrex's ordering.

Minor nitpick (non-blocking): the PR body's verification checklist has all three boxes (make fmt, make lint, make test) left unchecked. Since this is a README-only change, that's expected and the author notes it explicitly ("Not run: no Rust sources touched"), so this is fine as-is — just flagging that the checklist itself could be trimmed or annotated inline rather than left checked-off as [ ] if the intent is "not applicable."

No correctness, security, performance, or Rust-idiom concerns — there's no code in this diff. Good to merge.

---

Automated review by Claude (Anthropic) · sonnet · custom prompt

[github-actions]

🤖 Codex Code Review

No findings.

This PR is documentation-only. It adds a security reporting section in README.md and does not touch fork choice, attestation handling, justification/finalization, state transition, XMSS verification, SSZ, or any Rust execution path, so I do not see a correctness, security, performance, or memory-safety regression from this diff.

I also verified that the referenced policy file exists at .github/SECURITY.md and is consistent with the new README text. The only residual note is that I could not validate the rendered GitHub behavior of the ../../security/advisories/new link at README.md from the terminal, but nothing in the patch suggests a blocking issue.

---

Automated review by OpenAI Codex · gpt-5.4 · custom prompt