chore: bump version to 1.3.1

- update manifest.base.json, package.json and index.html to v1.3.1

- add SECURITY.md file

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Supported Versions
+
+We take the security of our users and their data very seriously. We actively support and patch the latest stable releases of KoalaSync. 
+
+| Version        | Supported          |
+| -------------- | ------------------ |
+| Latest Release | :white_check_mark: |
+| Older Versions | :x:                |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability within KoalaSync (e.g., related to the Node.js relay server, WebSocket wire protocol, or the Chrome/Firefox browser extension), please **DO NOT** report it by creating a public GitHub issue. 
+
+Publicly disclosing a vulnerability before a patch is available puts our users at risk. Instead, please send an email privately to the project administrator at:
+**koalasync_admin@koalamail.rocks**
+
+### What to expect
+1. **Acknowledgment**: You should receive an acknowledgment of your report within 48 hours.
+2. **Investigation**: We will investigate the issue, confirm its severity, and work on a patch.
+3. **Resolution**: We will notify you when the patch is deployed to the Chrome Web Store, Mozilla Add-on Store, and our GitHub Docker releases.
+4. **Disclosure**: Once the fix is confirmed and users have had time to update, we will publicly acknowledge your contribution in our release notes (unless you prefer to remain anonymous).