[addyCooks]

Description

Adds SECURITY.md: which components and versions are covered (the CLI, the VS Code extension and the published packages; latest release only), how to report a vulnerability privately through GitHub, a Discord fallback for anyone who can't use the form, what reporters can expect, and what is in and out of scope. It links to the existing hooks-security and directory-trust docs for the "trusted folders run their own code" model.

Note for maintainers: the policy points reporters at GitHub's private vulnerability reporting, which is currently disabled for this repository. It needs to be enabled under Settings > Code security > Private vulnerability reporting for the link to work. The policy also states a few choices worth a second look: latest-release-only support, credit for reporters in advisories and release notes, and no fixed response timelines.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Changeset

• Added a changeset (pnpm changeset) describing this change for the changelog

Docs-only, so no changeset.

Testing

Automated Tests

• New features include passing tests in .spec.ts/tsx files
• All existing tests pass (pnpm test:all completes successfully)
• Tests cover both success and error scenarios

Manual Testing

• Tested with Ollama
• Tested with OpenRouter
• Tested with OpenAI-compatible API
• Tested MCP integration (if applicable)

Checklist

• If this was for an open issue, I was assigned to it
• Code follows project style guidelines
• Self-review completed
• Documentation updated (if needed)
• No breaking changes (or clearly documented)
• Appropriate logging added using structured logging (see CONTRIBUTING.md)

[github-actions]

No changeset found

This PR does not add a changeset, so it will not appear in the changelog or trigger a release.

If the change is user-facing, add one:

pnpm changeset

Pick a bump (patch / minor / major) and write the changelog entry in our usual voice ("Added X... Thanks to @you. Closes #123."), then commit the generated .changeset/*.md file.

If this PR is docs-only or a chore that needs no release note, you can ignore this — or run pnpm changeset --empty to record that intentionally.

[github-actions]

nc-review: comments — 1 nit

@addyCooks — a few things worth a look, none blocking.

Adds a new top-level SECURITY.md describing scope, supported versions, reporting flow (GitHub private vulnerability report + Discord fallback), expectations, and in/out-of-scope examples. The doc-only change is well-scoped, written in the project's voice, and the cross-links to docs/features/hooks.md#security and docs/getting-started/index.md both resolve on disk. The only outstanding item is a maintainer-side one the author has already flagged: GitHub private vulnerability reporting is currently disabled for the repo, so the primary reporting link in the policy will 404 until Settings > Code security > Private vulnerability reporting is turned on.

⚪ nit · completeness · SECURITY.md:13

The primary reporting link under 'Reporting a vulnerability' points at GitHub's private vulnerability report form, which the author notes is currently disabled for this repository. The link will 404 until a maintainer enables Settings > Code security > Private vulnerability reporting on the repo. The author has surfaced this in the PR description, so the right action is a maintainer checkbox before merging — the Discord fallback already covers reporters in the interim.

---

_{🔴 blocking · 🟠 a reviewer would ask for a change · ⚪ optional}

_{Automated code review — correctness, security, design, tests, plus duplicates and scope. A human still decides; this is not a substitute for review and is not exhaustive. The required status checks separately cover lint, formatting, types, unused dependencies, the test suite and the build. This bot never merges. Maintainers can rerun with /re-review.}