No SECURITY.md — the repo is public with no vulnerability disclosure channel

The repo went public on 2026-09-14. There is no SECURITY.md — not at the root, not in .github/, not in docs/ — and repos/CopilotKit/outpost/community/profile confirms GitHub sees no security policy for the repo.

Why it matters now

While the repo was private, the absence was harmless: nobody outside the org could read the code, so nobody outside the org could find a vulnerability in it. That is no longer true. Anyone can now read every line of the auth, webhook-verification, tenant-isolation and token-handling paths, and there is currently no documented channel to tell us about what they find. The available options for an external reporter today are: open a public issue (which discloses the vulnerability to everyone at the same moment it reaches us), or give up. Neither is what we want.

Carried forward from #219, which listed "a security policy for reporting vulnerabilities" as a prerequisite for going source-available. The repo went source-available without it.

What is needed

Add SECURITY.md (root or .github/, either is picked up by GitHub's "Report a vulnerability" surface) covering:

• Where to report — a monitored address, and/or enable GitHub Private Vulnerability Reporting on the repo so reports arrive as a private advisory draft rather than a public issue.
• What not to do — do not open a public issue for a suspected vulnerability.
• Which versions are in scope — at minimum, main and whatever is deployed.
• Response expectations — acknowledgement window and a rough disclosure timeline, so a reporter knows whether silence means "working on it" or "lost".
• Scope boundaries — self-hosted deployments the reporter controls vs. our hosted instance.

Pathfinder is the obvious reference for the wording, same as it was for the license grant.

Done when

SECURITY.md exists on main, the GitHub community profile reports a security policy, and the "Report a vulnerability" path on the repo lands somewhere a human reads.

Start by reviewing the issue requirements and Pathfinder's security-policy wording, then add SECURITY.md at the root or in .github/. Verify that it covers reporting, public-issue guidance, supported versions, response expectations, and scope boundaries; confirm the GitHub community profile detects the policy and that the repository's Report a vulnerability path reaches a monitored destination.