docs: add security policy

[bcdonadio]

Summary

• Add the Donadio Solutions organization security policy to this repository.
• Document private vulnerability reporting through GitHub Private Vulnerability Reporting when available.
• Provide encrypted email reporting details and coordinated disclosure guidance.

Verification

• Confirmed SECURITY.md content matches the organization policy source.

Summary by CodeRabbit

• Documentation

  • Added a comprehensive SECURITY.md describing private vulnerability reporting (private GitHub reports or GPG-encrypted email to security@donadio.solutions), required report contents, in-scope asset categories, handling/triage, coordinated disclosure, and safe-harbor guidance; instructs not to use public issue threads for security reports.

• Chores

  • Pinned CI workflow action versions to fixed commits to make workflow behavior deterministic.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: fbf10e6b-945c-457b-bc45-e04a5a549362

📥 Commits

Reviewing files that changed from the base of the PR and between 641dc7e and 7f95b63.

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• .github/workflows/claude-code-review.yml
• .github/workflows/claude.yml
• SECURITY.md

---

📝 Walkthrough

Walkthrough

Adds an organization SECURITY.md specifying private vulnerability reporting (GitHub or GPG-encrypted email), required report contents, in-scope assets, triage and coordinated disclosure expectations, and safe-harbor rules; also pins multiple GitHub Actions in CI/workflows to specific commit SHAs.

Changes

Security Policy Documentation

Layer / File(s)	Summary
Pin GitHub Actions in workflows .github/workflows/ci.yml, .github/workflows/claude-code-review.yml, .github/workflows/claude.yml	Replaces tag-based action references with pinned commit SHAs for codecov/test-results-action, actions/checkout, and anthropics/claude-code-action, keeping step inputs and workflow logic unchanged.
Security policy and reporting procedures SECURITY.md	Complete vulnerability reporting policy with private reporting channels (GitHub and GPG-encrypted email), required report contents, asset scope, triage and severity handling, coordinated disclosure timing, and safe-harbor/prohibited actions guidance.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

🐰 I found a guarded burrow bright,
With keys and quiet lantern light,
I hop with care through encrypted lanes,
Leaving soft footprints, no loud refrains,
Whispering fixes through the night.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'docs: add security policy' accurately summarizes the primary change—adding a SECURITY.md file to document vulnerability reporting procedures.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch add-security-policy

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Adds a SECURITY.md file documenting the Donadio Solutions organization security policy, including private vulnerability reporting via GitHub and encrypted email, scope, handling process, coordinated disclosure, and safe harbor terms.

Changes:

• Introduces a new SECURITY.md at the repository root.
• Documents two reporting channels: GitHub Private Vulnerability Reporting and GPG-encrypted email.
• Provides scope, handling process, coordinated disclosure, and safe harbor guidance.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@SECURITY.md`:
- Line 3: Reflow the long paragraphs and list items in SECURITY.md (starting at
the paragraph that begins "Donadio Solutions takes security reports seriously.")
to satisfy MD013 by wrapping lines to a maximum of 120 characters; update the
specific long lines cited (around lines 20, 59, 76, 82, and 101) so each
sentence or list item is split into logical shorter lines, preserving
punctuation and Markdown structure (use a text wrap or format tool or manually
break sentences at natural boundaries).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4f688671-8841-450f-8e70-efdc36741978

📥 Commits

Reviewing files that changed from the base of the PR and between 2a511d3 and dff2cd1.

📒 Files selected for processing (1)

• SECURITY.md

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dff2cd1156

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!