[senyo888]

Scope

Add a root security policy and make private vulnerability reporting discoverable. GitHub-managed CodeQL default setup is now enabled for Python and GitHub Actions with security-extended queries, remote and local inputs, and weekly scanning.

Reason

The repository lacked a security policy and code scanning configuration. The policy explains reporting, trust boundaries, security properties, and validation limits without adding finding exclusions or response-time promises.

Files affected

• SECURITY.md: private reporting, versions, scope, and security guidance.
• README.md: link to the policy.
• docs/MAINTENANCE.md: CodeQL configuration, verification, and reporting instructions.

Runtime impact

Documentation and repository security configuration only; no runtime or artwork changes.

UI impact

GitHub can display the security policy. The pet catalogue and installers are unchanged.

Migration impact

None. No new release or pet version bump is needed; v1.0.1 remains unchanged.

Validation performed

• Initial CodeQL run 41197402487: Python and Actions succeeded on main at 657b234827be436f8b9e73d50967bbb7cbe738b2; both analyses uploaded with zero results and no warnings/errors.
• API readback confirms both languages, extended queries, remote/local inputs, weekly schedule, and private vulnerability reporting enabled.
• Repository preflight passed: eight-pet catalogue, local links, 16 GIF/PNG pairs, privacy checks, and ignored-file boundaries.
• Gitleaks history and public-file scans passed. Staged privacy and whitespace checks passed; the policy resolver applies root SECURITY.md to scripts.
• Dependabot still reports 41 open alerts from the prior dependency update; this PR does not claim they are cleared or dismiss them.

Rollback safety

The three documentation files can be reverted independently. CodeQL default setup is a GitHub setting, so reverting this PR alone does not disable it.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ae8256d1-bd93-4e91-bec0-c9eb54fc7785

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn