Use one consistent, publicly accessible security reporting route

## Problem

The repository's security-reporting documentation does not provide one consistent, publicly verifiable disclosure route.

At current `main@2de83cb43b759c7b3d07c749c6a3efccd4528007`:

- `README.md` directs reports to `sec@bytedance.com`;
- `SECURITY.md` directs reports to `src@bytedance.com` and says not to open public GitHub issues;
- README does not repeat that no-public-issue warning;
- the Bug Bounty Reward link in `SECURITY.md` is not anonymously readable: an anonymous HEAD returns HTTP 404, while an anonymous GET enters the Lark/Feishu sign-in redirect flow.

This report concerns the public reporting instructions only; it does not disclose a vulnerability.

## Reproduction

1. Compare the Security section in `README.md` with `SECURITY.md`.
2. Observe the different email addresses and missing no-public-issue warning in README.
3. Open the linked LarkOffice reward policy in an unauthenticated browser session.

## Expected behavior

All project-owned security documentation should name one canonical reporting email/portal, repeat the private-reporting requirement consistently, and link to an anonymously readable policy or clearly mark access restrictions.

## Actual behavior

External reporters must choose between conflicting email addresses and cannot review the linked reward policy anonymously.

## Impact

A reporter may use the wrong route, miss the private-disclosure requirement, or be unable to understand the referenced reward rules.

## Why this report has no PR

The repository does not establish which email address is authoritative or provide a known public replacement for the restricted reward-policy URL. Those operational details require confirmation from the ByteDance security team before the README, SECURITY file, web branch, and project page can be synchronized safely.

## Evidence

- Default branch: `main@2de83cb43b759c7b3d07c749c6a3efccd4528007`
- The web branch uses byte-identical README security text and SECURITY policy where applicable
- Anonymous link check on 2026-08-22: HEAD 404; GET remained in the sign-in redirect flow after 10 redirects

Compare the Security section in README.md with SECURITY.md, then inspect the linked LarkOffice reward policy from an unauthenticated session. Confirm the authoritative reporting email or portal and an accessible policy link with the ByteDance security team before editing the README, SECURITY file, web branch, and project page. Done means all project-owned security documentation uses one verified route and consistently requires private reporting.

Written by the indexing model from the issue text.