feat(tests): enhance modelTesterSession tests and add proxy logs tests

- Updated modelTesterSession tests to serialize assistant history as output_text and removed mime_type from input_file.
- Introduced new tests for stats proxy logs routes, covering paginated log retrieval and detailed log views with parsed billing details.
- Added server-driven tests for ProxyLogs component to validate API interactions and UI rendering based on server data.

SECURITY.md

@@ -2,22 +2,36 @@
 
 ## Supported Versions
 
-Only the latest `main` branch state is supported for security fixes.
+- The latest release on GitHub.
+- The current `main` branch.
+
+Older tags and ad-hoc forks may receive guidance, but they are not guaranteed security backports.
 
 ## Reporting a Vulnerability
 
-Please do not report security issues in public issues.
+Please do not report security issues in public issues, discussions, or pull requests.
 
 Use one of these channels:
 
-- GitHub Security Advisory private report (preferred)
-- Maintainer contact listed in project profile
+1. GitHub Security Advisory private report: `https://github.com/cita-777/metapi/security/advisories/new`
+2. Email: `cita-777@users.noreply.github.com` with subject prefix `[metapi security]`
 
 When reporting, include:
 
-- Affected endpoint/module
-- Reproduction steps
-- Potential impact
-- Suggested fix (if available)
+- Affected version, commit, or deployment mode
+- Affected endpoint, module, or configuration surface
+- Reproduction steps or proof-of-concept
+- Expected impact and attack preconditions
+- Any logs, screenshots, or packets with secrets redacted
+- Suggested mitigation or patch ideas, if you already have them
 
-We will acknowledge reports as soon as possible and coordinate a fix and disclosure timeline.
+## Response Process
+
+- We aim to acknowledge private reports within 3 business days.
+- We aim to provide an initial triage or follow-up questions within 7 business days.
+- We may ask for extra reproduction details, redacted logs, or environment information before confirming severity.
+- We coordinate disclosure with the reporter when possible. Please keep the report private until a fix or mitigation is ready.
+
+## Handling Public Reports
+
+If a vulnerability is posted publicly by mistake, maintainers may redact sensitive details, convert the report to a private channel, or close the public thread after redirecting the reporter to the private process above.