Create SECURITY.md

[zskbot]

---

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• SECURITY.md is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 018b1752-31c3-4119-862a-937353120094

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Add SECURITY.md security policy template

📝 Documentation 🕐 Less than 5 minutes

AI Description

• Add SECURITY.md with supported-version matrix template.
• Document (placeholder) guidance for reporting security vulnerabilities.

High-Level Assessment

The following are alternative approaches to this PR:

1. Use GitHub Security Advisory + minimal SECURITY.md

• ➕ Leverages GitHub’s built-in private vulnerability reporting workflow
• ➕ Keeps SECURITY.md short and avoids stale version tables
• ➖ Still requires maintainers to configure the advisory feature and triage process
• ➖ Less explicit for users who expect a detailed policy file

2. Adopt a standard policy template (e.g., OpenSSF)

• ➕ More comprehensive and consistent with common security-policy expectations
• ➕ Covers disclosure timelines and remediation expectations more explicitly
• ➖ Heavier-weight than many small projects need
• ➖ Requires more project-specific customization up front

Recommendation: Keep the SECURITY.md approach, but replace the placeholder text with project-specific reporting instructions (contact method, expected response times, and disclosure process). If you want private reporting and tracking, also enable GitHub Security Advisories and link to that workflow from SECURITY.md.

Files changed (1) +21 / -0

Documentation (1) +21 / -0

SECURITY.mdAdd SECURITY.md security policy template +21/-0

Add SECURITY.md security policy template

• Introduces a SECURITY.md file with a supported-versions table and a section outlining how to report vulnerabilities (currently using template placeholder text). This establishes a standard location for security guidance in the repository.

SECURITY.md

[devin-ai-integration]

Devin Review found 0 potential issues.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📜 Skill insights (0)

1. Missing vuln reporting info 🐞 Bug ⛨ Security

Description

The "Reporting a Vulnerability" section is still template text and does not provide any real
reporting channel (email, private advisory link, etc.), so security researchers have no guidance for
responsible disclosure.

Code

SECURITY.md[R15-21]

+## Reporting a Vulnerability
+
+Use this section to tell people how to report a vulnerability.
+
+Tell them where to go, how often they can expect to get an update on a
+reported vulnerability, what to expect if the vulnerability is accepted or
+declined, etc.

Evidence

The added section explicitly instructs the maintainer to fill in reporting details, but provides no
reporting destination or process as committed.

SECURITY.md[15-21]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`SECURITY.md` currently contains placeholder/template text under "Reporting a Vulnerability" and does not tell reporters where/how to disclose vulnerabilities privately.

## Issue Context
GitHub and external reporters commonly rely on `SECURITY.md` for the canonical vulnerability disclosure path. The current text does not include any actionable channel or expectations.

## Fix Focus Areas
- SECURITY.md[15-21]

## Suggested change
Replace the placeholder paragraphs with concrete instructions, for example:
- Where to report (e.g., GitHub Security Advisories link, or a security email alias)
- What information to include
- Expected response timelines and disclosure policy
- Whether to use public issues or not (generally: avoid public issues for vuln reports)

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Wrong supported versions 🐞 Bug ≡ Correctness

Description

The Supported Versions table lists 4.x/5.x releases as supported, but the repository declares
version 0.2.0 in both frontend and backend, making the policy misleading about what actually
receives security fixes.

Code

SECURITY.md[R8-13]

+| Version | Supported          |
+| ------- | ------------------ |
+| 5.1.x   | :white_check_mark: |
+| 5.0.x   | :x:                |
+| 4.0.x   | :white_check_mark: |
+| < 4.0   | :x:                |

Evidence

SECURITY.md introduces a 4.x/5.x support matrix, while the codebase indicates a 0.2.0 application
version (frontend package.json and backend FastAPI version/root response).

SECURITY.md[8-13]
frontend/package.json[1-5]
backend/main.py[8-12]
backend/main.py[24-31]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`SECURITY.md` claims support for versions 4.x and 5.x, which does not match the versioning currently declared by the application in this repo.

## Issue Context
The frontend and backend both declare version `0.2.0`, so the supported-versions table should reflect the project’s real release scheme (or explicitly document a separate scheme, if one exists).

## Fix Focus Areas
- SECURITY.md[8-13]

## Suggested change
Update the table to match the project’s actual supported releases (e.g., `0.2.x` supported, older minors unsupported), or remove the table until real supported versions are defined.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[zskbot]

.