docs: use the org-wide security policy

README.md

@@ -23,6 +23,8 @@ Requires the Node version in `engines.node` of [`package.json`](./package.json);
 pnpm add -D @putdotio/rokit
 ```
 
+Only the latest published version receives routine fixes.
+
 ## Quick Start
 
 Set the target Roku in the app repo that consumes `rokit`:
@@ -192,7 +194,7 @@ artifacts.
 - [Roku debugging](./docs/DEBUGGING.md)
 - [Distribution](./docs/DISTRIBUTION.md)
 - [rokit skill](./skills/rokit/SKILL.md)
-- [Security](./SECURITY.md)
+- [Security](https://github.com/putdotio/.github/blob/main/SECURITY.md)
 
 ## Repo Internals
 

docs/DISTRIBUTION.md

@@ -32,8 +32,8 @@ Release writes use the `putio-releaser` installation token. The default `GITHUB_
 
 `files` in [`package.json`](../package.json)
 lists what the npm package ships. It carries the docs, consumer skill, and
-generic live probe so agents consuming the package can inspect distribution,
-security, and Roku proof mechanics without cloning the repository. Packaged docs
+generic live probe so agents consuming the package can inspect distribution
+and Roku proof mechanics without cloning the repository. Packaged docs
 link files outside the tarball by absolute GitHub URL.
 
 The published dependencies pin Effect, platform-node, and platform-node-shared to

package.json

@@ -28,7 +28,6 @@
     "docs",
     "examples",
     "README.md",
-    "SECURITY.md",
     "skills"
   ],
   "type": "module",

test/package-config.test.ts

@@ -25,7 +25,7 @@ describe("package config", () => {
     const packageConfig = readPackageConfig();
 
     expect(packageConfig.files).toEqual(
-      expect.arrayContaining(["AGENTS.md", "docs", "examples", "README.md", "SECURITY.md"]),
+      expect.arrayContaining(["AGENTS.md", "docs", "examples", "README.md"]),
     );
   });
 });