Fix/add security policy

[Youngyz1]

Description

This PR [adds/changes/fixes]... (A description of your work goes here.)

Closes #__

Validation steps

1. (How can a reviewer validate your work?)

Additional notes for the reviewer

1. (Is there anything else the reviewer should know or look out for?)

AI Usage

Please disclose whether you've used AI anywhere in this PR (it's cool, we just
want to know!):

• I have used Claude Code
• I have used another model
• I have not used AI

You can read more details in our
Responsible AI Policy

Pre-submission checklist

• I have performed an AI review of my code (we recommend using /review
  with Claude Code)
• I have implemented and tested all related authorization policies.
  (e.g., :owner, :admin, :editor, :viewer)
• I have updated the changelog.
• I have ticked a box in "AI usage" in this PR

[josephjclark]

Thank you for flagging this @Youngyz1 . I've gone ahead and fixed this myself on the main branch.

A security policy isn't just a document we add to a repo It has to be part of our organisational process. We already have several layers of security which apply to this repo, including AI audits and notes in the readme

When raising PRs, please try and keep them as small and focused as possible so that its easy for maintainers to merge them 🙏

[Youngyz1]

Hi Joe, Thank you again for your kind response on my PR, and for going ahead and fixing the security policy yourself. Your feedback about keeping PRs small and focused was genuinely helpful, and it's something I'm actively working on. I'll be honest with you: I applied for a role at OpenFn recently and wasn't successful, but that hasn't dampened my interest in the project or the mission at all. OpenFn is exactly the kind of work I want to be part of open source, real-world impact, and a team that clearly cares about quality. I'm reaching out to ask if there's any way I could get involved in a more structured capacity, whether that's an internship, a junior contributor role, or even just a mentored contribution path. I'm not focused on the title or the pay. What I'm after is real production experience, working alongside people who can help me grow. I'm currently building my skills in full-stack development (React, .NET, Docker, Kubernetes) and I'm comfortable working independently. I'm based in Abidjan and available in EU/Africa timezones. If there's any opportunity, however small, I'd love to explore it. And if the timing isn't right, I'll keep contributing to the repo regardless. Thanks for your time, Joe. I really appreciate it. Best, Ohia Godwill

…

On Tue, May 12, 2026 at 10:45 AM Joe Clark ***@***.***> wrote: *josephjclark* left a comment (OpenFn/lightning#4707) <#4707 (comment)> Thank you for flagging this @Youngyz1 <https://github.com/Youngyz1> . I've gone ahead and fixed this myself on the main branch. A security policy isn't just a document we add to a repo It has to be part of our organisational process. We already have several layers of security which apply to this repo, including AI audits and notes in the readme <https://github.com/OpenFn/lightning#security-and-standards> When raising PRs, please try and keep them as small and focused as possible so that its easy for maintainers to merge them 🙏 — Reply to this email directly, view it on GitHub <#4707 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BWA6RQ7OKF7YQTXRAAOXRUL42LXC5AVCNFSM6AAAAACYSLK3MKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHM2DIMRZGI2TKMBZHE> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[josephjclark]

Hi @Youngyz1

Thanks for reaching out. I'd love to help but I'm not sure really - we're not in a position to take on contributors right now. Even volunteer work comes with a big cost for the organisation, and you can see from the PR page that we're struggling to keep up with contributions as it is.

I'll take a look over the backlog and see if there's are some issues that would be suitable for you to volunteer on