meta: clarify --harmony features are outside threat model

Signed-off-by: Matteo Collina <hello@matteocollina.com>

Author: mcollina

SECURITY.md

@@ -142,6 +142,25 @@ are not ready for public consumption and may have incomplete implementations,
 missing security hardening, or other limitations that make them unsuitable
 for production use.
 
+### Experimental features behind `--harmony` flags
+
+Node.js may expose V8 features that are controlled by `--harmony` flags
+(e.g., `--harmony-optional-chaining`, `--harmony-shadowrealm`). These flags
+enable V8-level JavaScript language features that are not part of the
+ECMAScript specification that Node.js implements and are not part of the
+Node.js documented API surface.
+
+* Security vulnerabilities that can only be triggered via `--harmony` flags
+  will **not** be accepted as valid security issues.
+* Any issues with these features will be treated as normal bugs.
+* No CVEs will be issued for issues that only affect `--harmony` flag features.
+* Bug bounty rewards are not available for `--harmony` flag feature issues.
+
+This policy recognizes that `--harmony` flags expose experimental V8 features
+that are not part of the Node.js documented API surface, are not enabled by
+default in production builds, and may have incomplete implementations or
+missing security hardening.
+
 ### What constitutes a vulnerability
 
 Being able to cause the following through control of the elements that Node.js