docs: document contribution and security workflows

[boh5]

Summary

• document the protected main pull request workflow and required GitHub gates
• add a pull request template for validation, documentation, and security context
• publish a repository security policy and distinguish it from product trust-boundary documentation
• link the contribution and vulnerability-reporting guidance from existing documentation

Why

The repository now requires pull requests, Verify, CodeQL scanning, resolved review conversations, and squash merging, but the contributor and agent documentation did not describe that workflow. The repository also lacked a GitHub-recognized security policy and private vulnerability-reporting guidance.

Validation

• git diff --cached --check
• git diff origin/main...HEAD --check
• confirmed GitHub Private vulnerability reporting is enabled
• reviewed the staged and committed diff for the six intended documentation files

This is a documentation-only change, so code tests were not run.

Summary by CodeRabbit

• Documentation
  • Added a security policy covering in-scope versions, private vulnerability reporting steps, required report details, fallback handling, and coordinated disclosure expectations.
  • Updated README and security documentation to point to the new vulnerability reporting guidance.
  • Refined contribution and pull request workflow instructions, including branch-from-latest-main requirements, required gates (Verify, CodeQL), AI advisory response guidance, and squash-merge expectations.
  • Added a standardized pull request template with structured sections and validation/security checklists.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 290e59f3-8996-4146-bf7b-c3838cf9d16b

📥 Commits

Reviewing files that changed from the base of the PR and between 626888c and 29b61b0.

📒 Files selected for processing (1)

• CONTRIBUTING.md

---

📝 Walkthrough

Walkthrough

Adds repository contribution rules, a standardized pull request template, and a security policy covering private vulnerability reporting, fallback handling, and coordinated disclosure.

Changes

Repository Governance and Security

Layer / File(s)	Summary
Contribution workflow and pull request guidance .github/pull_request_template.md, AGENTS.md, CONTRIBUTING.md	Documents branch setup, local validation, required checks, review handling, squash merges, and pull request template requirements.
Private vulnerability reporting policy SECURITY.md, CONTRIBUTING.md, README.md, docs/security.md	Adds private reporting procedures, report requirements, fallback instructions, disclosure expectations, and links to the security policy.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the documentation-focused changes around contribution and security workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CONTRIBUTING.md`:
- Around line 59-60: Update the branching instructions in CONTRIBUTING.md to
explicitly fetch the latest origin/main before creating a focused branch, and
use origin/main as the branch source instead of local main. Preserve the
existing fork guidance for contributors without write access.
- Around line 181-183: Update the security-reporting guidance in CONTRIBUTING.md
to prohibit opening public issues for all suspected vulnerabilities, while
retaining the existing examples of secrets, authentication bypasses, and
private-workspace exposure and the reference to SECURITY.md.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 873a4b1b-7713-4eaa-8ec2-eaeee0d2a322

📥 Commits

Reviewing files that changed from the base of the PR and between 4c4ce4e and 1f223cb.

📒 Files selected for processing (6)

• .github/pull_request_template.md
• AGENTS.md
• CONTRIBUTING.md
• README.md
• SECURITY.md
• docs/security.md

[cubic-dev-ai]

All reported issues were addressed across 6 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 1 file (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>