docs(security): fix contact address and correct the scope section

The reporting address was missing its @ and was unusable. The scope
section described an unrelated static-site generator; replace it with
the YAML parsing, validation, and emitting surface that is actually in
scope (malformed-input DoS, misrepresented values, validation as a
trust boundary).

CHANGELOG.md

@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Documentation
+
+- Correct `SECURITY.md`: fix the reporting contact address and replace the
+  scope section, which described an unrelated static-site generator, with the
+  YAML parsing, validation, and emitting surface that is actually in scope.
+
 ## [0.1.5] - 2026-06-23
 
 ### Documentation

SECURITY.md

@@ -5,7 +5,7 @@
 If you believe you have found a security issue in PureYAML, please report it
 privately. Do not open a public issue for security problems.
 
-Email **mihaelamj.com** with:
+Email **mihaelamj@gmail.com** with:
 
 - A description of the issue and its impact.
 - Steps to reproduce, or a proof of concept.
@@ -23,6 +23,13 @@ supported.
 
 ## Scope
 
-PureYAML generates static sites. The generated output is plain HTML, CSS, and
-client-side JavaScript for rich tiles. Reports about generated output (for
-example, missing output escaping that enables script injection) are in scope.
+PureYAML parses, validates, and emits YAML. Reports about how the library
+handles untrusted input are in scope, for example:
+
+- Malformed or adversarial input that causes a crash, an unbounded loop, stack
+  overflow, or excessive memory or CPU use.
+- Parser or emitter behavior that misrepresents input in a way a consumer could
+  rely on for a security decision (for example, a value that round-trips to a
+  different meaning).
+- Incorrect rejection or acceptance of input by the validation layer that a
+  consumer treats as a trust boundary.