Write a public security policy page for a client site

CLIENT CONTEXT: [small nonprofit, WordPress site with a donation form
processed through a third-party payment processor, no in-house security team,
one part-time developer who also handles the hosting account. They want a
public security policy page after a supporter asked how to report a bug they
noticed in the donation form, and there was nowhere to send them.]

Draft the actual page content, not a template with blanks left everywhere:
1. Scope section: what's covered (the main website and donation flow) and what
   isn't (the third-party payment processor's own systems, which should be
   reported to that processor directly since this client doesn't control that
   infrastructure).
2. Reporting instructions: a dedicated contact method (a specific email
   alias, not a general info@ inbox that gets missed), what information to
   include in a report to make it actionable, and a placeholder for a PGP key
   if they want to support encrypted reports later.
3. Response commitments the part-time developer can realistically keep: an
   acknowledgment window (state a specific number of business days) and how
   often they'll provide status updates, since promising same-day response
   from a one-person team sets up a broken promise.
4. Safe-harbor language: a plain statement that good-faith security research
   conducted within the stated scope won't be treated as a legal threat, which
   is what encourages researchers to report rather than post publicly first.
5. What's explicitly out of scope for a small site like this: social
   engineering against staff, physical security, and denial-of-service testing,
   stated clearly so a well-meaning researcher doesn't accidentally cause an
   outage while trying to help.