docs(SECURITY.md): add SECURITY.md with AI usage disclosure

[chimurai]

Summary by CodeRabbit

• Documentation
  • Added a security policy outlining supported versions, vulnerability reporting, and expectations for AI-assisted reports.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: c3bb0823-aa59-4bb4-ac9c-d441171ccd80

📥 Commits

Reviewing files that changed from the base of the PR and between 64426dc and 40bafd1.

📒 Files selected for processing (1)

• SECURITY.md

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

Added a security policy that lists supported versions, directs vulnerability reports to GitHub Security Advisories, and sets requirements for AI disclosure and report verification.

Changes

Security policy

Layer / File(s)	Summary
Security reporting requirements SECURITY.md	The policy lists versions 4.x and 3.x as supported and versions 2.x, 1.x, and 0.x as unsupported. It directs reports to GitHub Security Advisories and sets AI disclosure, human verification, and report-quality requirements.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 40baf

This documentation-only change adds a security policy and has no runtime impact. It is safe to merge, though maintainers should confirm that private vulnerability reporting is enabled in the repository settings.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 40baf

Only security-policy documentation changes. Its reporting route depends on GitHub settings that have not been confirmed. No introduced vulnerability has been verified, but the unresolved reporting-access question prevents a minimal-risk assessment.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The unresolved exposure concerns repository-level vulnerability-report intake and external reporters' access to it. The supplied candidate does not establish an application exploit or broader service exposure.

Security Findings and Attack Paths

• observed — The reporting-route candidate is deferred because the available API response does not establish the private vulnerability reporting setting. No retained security finding or demonstrated confidentiality failure is supplied.

Trust Boundaries and Controls

• inferred — The intended reporting workflow crosses from an external reporter to GitHub-controlled repository permissions. A documented advisory URL does not prove that private reporting is enabled or available to that reporter. The PR also does not establish a change to those permissions.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding SECURITY.md with an AI usage disclosure.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chimurai]

@copilot fix lint issue

[coveralls]

coverage: 96.364%. remained the same — docs-security-md into master

[Copilot]

@copilot fix lint issue

Fixed the SECURITY.md formatting; yarn lint passes. Commit: 40bafd1.

[pkg-pr-new]

npm i https://pkg.pr.new/http-proxy-middleware@1301

commit: 40bafd1