[erraggy]

Before: the repo had no security policy, so there was no documented place to report a vulnerability, and the OSS Scanner triage could not check the contact email.

After: SECURITY.md names oastools@robnrob.com as the private reporting contact, lists the supported versions and the areas of most interest, and points to .oss-scanner/threat_model.md.

How: one new markdown file, no code changes.

🤖 Generated with Claude Code

---

Generated by Claude Code

[coderabbitai]

📝 Walkthrough

📝 Walkthrough

📝 Walkthrough

Walkthrough

Added a security policy that describes supported versions, vulnerability reporting, follow-up, reporter credit, and risks in scope.

Changes

Security policy

Layer / File(s)	Summary
Security reporting and scope SECURITY.md	Added supported-version guidance, private reporting instructions and requested details, follow-up and reporter credit information, and a link to the threat model.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

---

---

---

---

Merge Risk: 🔵 Low · up to da325

The policy may publicly credit a reporter who misses the opt-out, and readers must navigate manually to the threat model. These are bounded documentation concerns; address or accept them before merging.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description clearly explains the addition of SECURITY.md, including the reporting contact, supported versions, areas of interest, and threat model link.
Title check		The title clearly and concisely describes the main change: adding SECURITY.md with a vulnerability reporting contact.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

---

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.22%. Comparing base (6454700) to head (9ff6380).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #557   +/-   ##
=======================================
  Coverage   88.22%   88.22%           
=======================================
  Files         223      223           
  Lines       31499    31499           
=======================================
  Hits        27791    27791           
  Misses       2407     2407           
  Partials     1301     1301           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[coderabbitai]

Actionable comments posted: 2

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d247421a-6b57-4926-aa68-bed912be1bb3

📥 Commits

Reviewing files that changed from the base of the PR and between 6454700 and da325dc.

📒 Files selected for processing (1)

• SECURITY.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.