Create SECURITY.md

[zskbot]

---

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Documentation
  • Added a security policy outlining supported versions and instructions for reporting vulnerabilities.

Walkthrough

Adds SECURITY.md with a supported versions table and instructions for reporting vulnerabilities.

Changes

Security Policy

Layer / File(s)	Summary
Security policy documentation SECURITY.md	Adds supported-version guidance and standard instructions for reporting vulnerabilities.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested labels: ClaudeRiks

Poem

A rabbit found a policy neat,
With version rows all lined complete.
“Report bugs here,” the pages say,
And hop securely through the day.
🐇🔒

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is just a review badge and does not describe the pull request changes.	Replace the badge-only content with a brief summary of the SECURITY.md addition and its purpose.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately reflects the main change: adding a new SECURITY.md file.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[qodo-code-review]

PR Summary by Qodo

Add SECURITY.md security policy template

📝 Documentation 🕐 Less than 5 minutes

AI Description

• Add a SECURITY.md file describing supported versions and vulnerability reporting.
• Provide a starting point for a formal security disclosure process.

High-Level Assessment

The following are alternative approaches to this PR:

1. Use GitHub Security Advisories + private reporting link

• ➕ Standardizes inbound reports via GitHub UI
• ➕ Enables private discussions, CVE workflows, and coordinated disclosure
• ➖ Requires repo configuration/permissions and maintainer process adoption
• ➖ Less useful if you prefer email-based intake

2. Replace template with project-specific policy now

• ➕ Avoids publishing placeholder instructions and incorrect supported-version claims
• ➕ Gives reporters clear, actionable steps immediately
• ➖ Requires upfront agreement on SLA/contact method/support window

Recommendation: Keep SECURITY.md, but replace the placeholder text and example version table with the project’s real supported versions, a concrete reporting channel (email address or GitHub security advisory link), and an expected response timeline. Publishing a template as-is can mislead reporters and creates unclear expectations.

Files changed (1) +21 / -0

Documentation (1) +21 / -0

SECURITY.mdAdd SECURITY.md security policy template +21/-0

Add SECURITY.md security policy template

• Introduces a SECURITY.md file with sections for supported versions and vulnerability reporting. Currently contains template guidance text and an example support matrix that should be customized for this project.

SECURITY.md

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@SECURITY.md`:
- Around line 17-21: Replace the placeholder guidance in SECURITY.md with the
repository’s actual vulnerability disclosure process, including the private
reporting channel, acknowledgement and status-update cadence, and what reporters
should expect when a submission is accepted or declined. Remove the template
text while preserving the document’s security-policy structure.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: ca759fb3-7e74-43e7-adb3-21a3859f8e29

📥 Commits

Reviewing files that changed from the base of the PR and between 4c2fd1a and 8626e7d.

📒 Files selected for processing (1)

• SECURITY.md

📜 Review details

🔇 Additional comments (1)

SECURITY.md (1)

8-13: 🔒 Security & Privacy

Verify the supported-version claims before publishing.

The table asserts support for 5.1.x and 4.0.x, but the supplied context does not establish that these versions exist or receive security updates. Confirm the matrix against the repository’s release history to avoid misleading users about patch availability.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📜 Skill insights (0)

1. No reporting instructions 🐞 Bug ⛨ Security

Description

The new SECURITY.md leaves “Reporting a Vulnerability” as placeholder template text and provides no
actionable/private reporting channel. This prevents responsible disclosure because security
reporters aren’t told where to submit vulnerabilities.

Code

SECURITY.md[R15-21]

+## Reporting a Vulnerability
+
+Use this section to tell people how to report a vulnerability.
+
+Tell them where to go, how often they can expect to get an update on a
+reported vulnerability, what to expect if the vulnerability is accepted or
+declined, etc.

Evidence

The added section contains only generic template guidance and no contact/reporting destination;
README provides no alternative instructions, so reporters have no clear path.

SECURITY.md[15-21]
README.md[1-1]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`SECURITY.md` does not provide any actual vulnerability reporting mechanism (email, GitHub Security Advisories link, private contact form, etc.) and instead contains only template placeholder instructions.

## Issue Context
The repository README is empty, so `SECURITY.md` is the only obvious place for security reporting guidance.

## Fix Focus Areas
- SECURITY.md[15-21]

### Suggested change
Replace the placeholder text with concrete instructions, e.g.:
- Where to report (preferred: GitHub Security Advisories private report URL, or `security@<domain>` email)
- What information to include
- Expected response timelines
- Disclosure policy (coordinated disclosure expectations)
- PGP key (optional)

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Misleading supported versions 🐞 Bug ⚙ Maintainability

Description

SECURITY.md declares support for versions like 5.1.x and 4.0.x, which does not match the repo’s own
declared versioning (0.2.0 in both backend and frontend). This misstates the project’s
supported-version policy and can confuse users/reporters about what releases receive security fixes.

Code

SECURITY.md[R5-13]

+Use this section to tell people about which versions of your project are
+currently being supported with security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 5.1.x   | :white_check_mark: |
+| 5.0.x   | :x:                |
+| 4.0.x   | :white_check_mark: |
+| < 4.0   | :x:                |

Evidence

The new SECURITY.md uses a stock template version matrix that conflicts with the versions declared
by the running backend and the frontend package metadata, demonstrating the listed supported
versions are not aligned to this repo.

SECURITY.md[5-13]
backend/main.py[8-12]
frontend/package.json[1-4]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`SECURITY.md` contains a template “Supported Versions” section listing `5.1.x`, `5.0.x`, `4.0.x`, etc., which does not correspond to this repository’s versioning (the app declares `0.2.0`). This makes the security support policy misleading.

## Issue Context
- Backend declares `version="0.2.0"`.
- Frontend `package.json` declares `version: "0.2.0"`.

## Fix Focus Areas
- SECURITY.md[5-13]

### Suggested change
Replace the template table with your real support policy (e.g., `0.2.x` supported / older unsupported), or explicitly state that only the latest release is supported (or that the project is pre-1.0 and only `main`/latest is supported).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---