update to ensure same wording on all sources

Author: skadefro

docs/architecture/Security Model & Features.md

@@ -120,16 +120,39 @@ OpenCore provides comprehensive audit capabilities to meet regulatory and compli
 
 ---
 
-## Vulnerability Management & Security Notices
+# Vulnerability Management & Security Policy
 
-Staying up to date with security fixes is critical.
+## Reporting a Vulnerability
+
+If you discover any security issues, please let us know by one of the following methods:
+
+- **GitHub Private Security Advisories**  
+  Submit a private advisory on this repository.
+- **Email**  
+  Send an email to **security@openiap.io**.
+
+We aim to acknowledge all valid reports within **48 hours**.
+
+## Supported Versions
+
+We actively provide security fixes for the **two most recent major releases**.  
+If you’re running an older version, please upgrade to continue receiving important updates.
+
+## Security Updates
 
 - **GitHub Security Advisories**  
-  Subscribe to the OpenCore repository if you want to be update on security and bug fixes. 
+  Subscribe to be notified of any published advisories.  
 - **Dependabot & Automated Scans**  
-  We use dependabot and github automated Security and code scanning. And we prefere people use github's "Private vulnerability reporting" feature to report vulnerabilities.
-- **Disclosure Policy**  
-  Alernatively, you can report vulnerabilities via security at openiap.io. Our team typically responds within 48 hours, if the report has a real security vulnerabilities and will send out public advisory for paying customers in case for seriuse issues, that need patching. We do not offer bounty programs at this time.
+  We use Dependabot and GitHub’s code-scanning tools to catch vulnerabilities early.  
+- **Third-Party Review & Penetration Testing**  
+  We engage with independent auditors—hired by organizations using our platform—to perform annual code reviews and active penetration tests.
+
+## Disclosure & Bounty
+
+- Public disclosure is encouraged once a fix is available.  
+- We do **not** currently run a paid bug-bounty program.
+
+Thank you for helping us keep the project secure!
 
 ---