docs: add security policy

[esthor]

Summary

• define supported security-fix targets and private reporting instructions
• document the repository's public agent-guidance and packaging boundary
• establish review invariants for credentials, host controls, deterministic tooling, source resolution, and release provenance
• clarify reportable repository vulnerabilities and out-of-scope service or fork behavior

Why

Installable agent guidance and release packaging need a public policy that helps contributors and security reviewers distinguish repository vulnerabilities from unrelated service behavior.

Validation

• git diff --check
• resolved the repository policy chain with Codex Security's resolve_security_md.py; the new root SECURITY.md is the only applicable policy
• verified GitHub private vulnerability reporting is enabled

Merge ordering

Merge #27 first so the current release workflow satisfies this policy's immutable Action-reference and provenance invariants.

[coderabbitai]

📝 Walkthrough

Walkthrough

Added SECURITY.md with repository security policy details. The policy defines supported-version coverage, private vulnerability reporting procedures, required report information, prohibited sensitive data, security invariants, reportable vulnerability categories, and exclusions.

Suggested reviewers: juanpflores, nehal-a2z

Poem

I’m a rabbit who guards the gate,
With rules for reports that must not wait.
Keep secrets private, paths clear and bright,
Protect each release with careful sight.
Hop, hop—security is set right!

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the addition of the repository security policy.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch esthor/add-security-policy

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch esthor/add-security-policy

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@SECURITY.md`:
- Around line 38-39: Update the release workflow references for actions/checkout
and softprops/action-gh-release to use their verified full commit SHAs instead
of mutable version tags, preserving the existing action versions and
configuration.
- Around line 10-12: Enable GitHub’s private vulnerability reporting setting for
the coderabbitai/skills repository before merging, so the Report a vulnerability
form referenced in SECURITY.md can accept private submissions.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 9f788b60-7f7a-497d-a27d-c0c9b8db66b7

📥 Commits

Reviewing files that changed from the base of the PR and between 083cb4b and 4945e6f.

📒 Files selected for processing (1)

• SECURITY.md

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• coderabbitai/bitbucket (manual)

📜 Review details

⚠️ CI failures not shown inline (2)

GitHub Actions: Required approver / 0_verify.txt: docs: add security policy

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1mowner="${REPOSITORY%%/*}"�[0m
 �[36;1mrepo="${REPOSITORY#*/}"�[0m
 �[36;1m�[0m
 �[36;1mresponse="$(�[0m
 �[36;1m  gh api graphql \�[0m
 �[36;1m    -f owner="$owner" \�[0m
 �[36;1m    -f repo="$repo" \�[0m
 �[36;1m    -F number="$PR_NUMBER" \�[0m
 �[36;1m    -f query='�[0m
 �[36;1m      query($owner: String!, $repo: String!, $number: Int!) {�[0m
 �[36;1m        repository(owner: $owner, name: $repo) {�[0m
 �[36;1m          pullRequest(number: $number) {�[0m
 �[36;1m            isDraft�[0m
 �[36;1m            reviews(last: 100) {�[0m
 �[36;1m              nodes {�[0m
 �[36;1m                author {�[0m
 �[36;1m                  login�[0m
 �[36;1m                }�[0m
 �[36;1m                commit {�[0m
 �[36;1m                  oid�[0m
 �[36;1m                }�[0m
 �[36;1m                state�[0m
 �[36;1m                submittedAt�[0m
 �[36;1m              }�[0m
 �[36;1m            }�[0m
 �[36;1m          }�[0m
 �[36;1m        }�[0m
 �[36;1m      }�[0m
 �[36;1m    '�[0m
 �[36;1m)"�[0m
 �[36;1m�[0m
 �[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
 �[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
 �[36;1m  echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mapproved_by="$(�[0m
 �[36;1m  jq -r \�[0m
 �[36;1m    --arg head "$HEAD_SHA" \�[0m
 �[36;1m    --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
 �[36;1m    '�[0m
 �[36;1m      .data.repository.pullRequest.reviews.nodes�[0m
 �[36;1m      | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
 �[36;1m      | sort_by(.author.login)�[0m
 �[36;1m      | group_by(.author.login)�[0m
 �[36;1m      | map(max_by(.submittedAt))�[0m
 �[36;1m      | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
 �[36;1m      | first.author.login // empty�[0m
 �[36;1m    ...

---

GitHub Actions: Required approver / verify: docs: add security policy

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1m�[0m
 �[36;1mowner="${REPOSITORY%%/*}"�[0m
 �[36;1mrepo="${REPOSITORY#*/}"�[0m
 �[36;1m�[0m
 �[36;1mresponse="$(�[0m
 �[36;1m  gh api graphql \�[0m
 �[36;1m    -f owner="$owner" \�[0m
 �[36;1m    -f repo="$repo" \�[0m
 �[36;1m    -F number="$PR_NUMBER" \�[0m
 �[36;1m    -f query='�[0m
 �[36;1m      query($owner: String!, $repo: String!, $number: Int!) {�[0m
 �[36;1m        repository(owner: $owner, name: $repo) {�[0m
 �[36;1m          pullRequest(number: $number) {�[0m
 �[36;1m            isDraft�[0m
 �[36;1m            reviews(last: 100) {�[0m
 �[36;1m              nodes {�[0m
 �[36;1m                author {�[0m
 �[36;1m                  login�[0m
 �[36;1m                }�[0m
 �[36;1m                commit {�[0m
 �[36;1m                  oid�[0m
 �[36;1m                }�[0m
 �[36;1m                state�[0m
 �[36;1m                submittedAt�[0m
 �[36;1m              }�[0m
 �[36;1m            }�[0m
 �[36;1m          }�[0m
 �[36;1m        }�[0m
 �[36;1m      }�[0m
 �[36;1m    '�[0m
 �[36;1m)"�[0m
 �[36;1m�[0m
 �[36;1mis_draft="$(jq -r '.data.repository.pullRequest.isDraft' <<<"$response")"�[0m
 �[36;1mif [[ "$is_draft" == "true" ]]; then�[0m
 �[36;1m  echo "Draft PRs cannot merge; approver gate will run when ready for review."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1m�[0m
 �[36;1mapproved_by="$(�[0m
 �[36;1m  jq -r \�[0m
 �[36;1m    --arg head "$HEAD_SHA" \�[0m
 �[36;1m    --argjson approvers "$(jq -Rc 'split(",")' <<<"$REQUIRED_APPROVERS")" \�[0m
 �[36;1m    '�[0m
 �[36;1m      .data.repository.pullRequest.reviews.nodes�[0m
 �[36;1m      | map(select((.author.login // "") as $login | $approvers | index($login)))�[0m
 �[36;1m      | sort_by(.author.login)�[0m
 �[36;1m      | group_by(.author.login)�[0m
 �[36;1m      | map(max_by(.submittedAt))�[0m
 �[36;1m      | map(select(.state == "APPROVED" and .commit.oid == $head))�[0m
 �[36;1m      | first.author.login // empty�[0m
 �[36;1m    ...

🧰 Additional context used

🔀 Multi-repo context coderabbitai/bitbucket

Linked repositories findings

coderabbitai/bitbucket

• README.md:37-74 documents Basic and Bearer authentication using credentials, relevant to the new policy’s credential-handling guidance. [::coderabbitai/bitbucket::]
• src/server/index.ts:5 exports webhook interfaces, confirming webhook contracts are part of the public package surface. [::coderabbitai/bitbucket::]
• CONTRIBUTING.md:5 documents publishing to NPM, GitHub Packages, and GitHub Releases on tag pushes, relevant to release-provenance and packaging-boundary statements. [::coderabbitai/bitbucket::]
• No SECURITY.md or direct consumer of the new policy was found.

🔇 Additional comments (1)

SECURITY.md (1)

38-39: 🔒 Security & Privacy

Verify version-tag protection.

The release workflow archives the triggering v* tag. The available repository settings do not establish whether tag protection prevents unauthorized tag creation or movement.