Update SECURITY.md for September 2026

[github-actions]

Automated SECURITY.md Update

This PR automatically updates SECURITY.md with the current version information.

Changes:

• Current version: 26.8.12
• Updated supported versions table
• Updated "Last Updated" date to September 2026
• Updated copyright year

Review Checklist:

• Version numbers are correct
• Support tier months are accurate
• Copyright year is current

This PR was automatically generated by the update-security-doc workflow.

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[logbie]

Automated triage: this PR's CI never started — all three workflows are parked awaiting manual approval.

Verified this morning against the run list for auto/update-security-doc-1788223100:

Workflow	Run	Event	Conclusion	Jobs
CI	33455570085	pull_request	action_required	0
Claude Code Review	33455570082	pull_request	action_required	0
WFL Config Lint	33455570062	pull_request	action_required	0

Zero jobs on all three — they were created and immediately parked, waiting for a maintainer to press Approve and run. The only green checks on the head sha (459ec5f) are the CodeQL analyses, which aren't gated the same way. So nothing has actually built, formatted, linted or tested this branch, and the green ticks above the merge box are misleading about coverage.

Root cause. update-security-doc.yml passes token: ${{ secrets.GITHUB_TOKEN }} to peter-evans/create-pull-request@v8 (L57-59). Events raised by GITHUB_TOKEN deliberately do not start new workflow runs — the action's own documentation calls this out — so a PR opened this way arrives with its pull_request workflows in action_required rather than running.

Two ways forward:

1. Right now — click Approve and run on the three runs above. The diff is two lines of Markdown; it should sail through.
2. Durably — author the PR with a PAT or GitHub App installation token held as a repo secret instead of GITHUB_TOKEN (token: ${{ secrets.SECURITY_DOC_PAT }}). That needs a secret only @logbie can create, so I have deliberately not pushed that change — swapping in a reference to a secret that doesn't exist yet would take the workflow from "PR needs a click" to "workflow is broken."

On the content itself — the diff is correct. Last Updated August → September 2026 and Version 26.8.2 → 26.8.12; main is at 26.8.12 (36b54444, "Bump version to 26.8.12"). The PR body's checklist also mentions the supported-versions table and the copyright year, but the actual diff touches only the two footer lines — that's the body template being generic, not a discrepancy in SECURITY.md.

Worth recording: this is the first update-security-doc scheduled run ever to succeed. Every scheduled run from 2026-02-01 through 2026-08-01 failed — seven consecutive months — and the only prior successes were the two manual dispatches on 2026-08-14 taken after the org Actions-allowlist fix. Today's schedule run (33455535837) went green end to end and produced this PR. The workflow is healthy; the approval gate is the one remaining rough edge.

Posted by the WFL repo warden (automated triage pass). No local toolchain in this sandbox — every claim above is from the GitHub REST API and the workflow file on main, not from a local build.