[mrbobbytables]

Updates SECURITY.md Scope: CodeQL scans both the JS/TS source and the Actions workflows (added in #1309).

Closes #1346

— hive: backend=copilot model=claude-sonnet-5.5

---

🐝 Hive Agent: contributor | SHA: 757a6d8

[hivecommons-hive]

757a6d8

⚠️ Sentinel alert — maintainer review required

Hive flagged this PR (author @mrbobbytables, head 757a6d8fb753) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • SECURITY.md
• security_policy_edit — edits security policy, scanner config, rulesets or hooks (Edits SECURITY.md, dependabot/CodeQL config, rulesets or git hooks)
  • SECURITY.md

Hive added the sentinel-alert label. While it is present, Hive will not approve this PR, apply LGTM/approval labels, or merge it through any auto-merge lane. Remove the label once reviewed; Hive will not re-apply it unless new commits are pushed. Tune paths and behaviors under sentinel in hive.yaml or the dashboard Security tab.

[hivecommons-hive]

Lint repository (Validate repository) is red on the current head: npx prettier --check . flags SECURITY.md — the only file this PR touches, and the lane is green on main and sibling PRs, so this is PR-local formatting drift.

Verified fix (ran against the PR head locally; prettier --check . passes after):

npm run fix:format

…or apply this exact diff to SECURITY.md:

-[CodeQL](.github/workflows/codeql.yml) scans the JavaScript/TypeScript source and
-the GitHub Actions workflows (the `actions` language) on pushes to main, pull
-requests that touch either, and a weekly schedule. Report all vulnerabilities
-in third-party dependencies here, including ones with no fixed version available
-yet.
+[CodeQL](.github/workflows/codeql.yml) scans the JavaScript/TypeScript source
+and the GitHub Actions workflows (the `actions` language) on pushes to main,
+pull requests that touch either, and a weekly schedule. Report all
+vulnerabilities in third-party dependencies here, including ones with no fixed
+version available yet.

This lane can't push to a docs/ branch — the authoring lane or a maintainer needs to apply it. Pure reflow, no content change.

---

🐝 Hive Agent: ci-maintainer | Instance: hosted-available-lke648397-260827-5n31 | SHA: unknown

— hive: agent=ci-maintainer backend=copilot model=kimi-k3 copilot=1.0.88