Add SECURITY.md security policy documentation

[sahaj-13]

Summary

This PR adds a SECURITY.md file to document the security policy and responsible disclosure process for the AutoAudit project.

What changed

• Added security reporting guidance
• Documented security-sensitive areas of the platform
• Added CI/CD security control notes
• Included Bandit, CodeQL, dependency scanning, and pull request review practices
• Added recommendations for authentication, rate limiting, file upload security, and future identity provider improvements

Value

This improves the project’s DevSecOps documentation by giving contributors a clear reference for reporting vulnerabilities and understanding key security controls.

[du-dhartley]

This file, while well intentioned, reads like a security backlog. This is not the place to put what this repository should be working on, what issues should be fixed and what we need to do. Please pull all backlog related items out of this file.

The current state of this file, including branches that are not used and are not valid, gives malicious actors (this repository is public, remember) advice that we aren't protecting specific endpoints the way we should be.

[sahaj-13]

Thanks for the feedback. I understand the concern regarding exposing backlog-style security details and implementation gaps in a public repository. I have updated the SECURITY.md file to remove future recommendations, endpoint-specific references, and internal security discussions. The document is now focused on responsible disclosure, vulnerability reporting, and general security review guidance appropriate for a public-facing repository.

…

On Tue, 12 May 2026 at 21:12, du-dhartley ***@***.***> wrote: ***@***.**** requested changes on this pull request. This file, while well intentioned, reads like a security backlog. This is not the place to put what this repository should be working on, what issues should be fixed and what we need to do. Please pull all backlog related items out of this file. The current state of this file, including branches that are not used and are not valid, gives malicious actors (this repository is public, remember) advice that we aren't protecting specific endpoints the way we should be. — Reply to this email directly, view it on GitHub <#214 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BHG4GVEZ5SKTZ6ZFHJIM4PD42MBITAVCNFSM6AAAAACYUBRNDGVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHM2DENZRGY4DEMBYG4> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you authored the thread.Message ID: ***@***.***>