Add automated security scanning and harden release pipeline

- Dependabot: weekly automated PRs for Python deps and Actions pins
- CodeQL: SAST on push/PR/weekly, results in GitHub Security tab
- pip-audit: dependency CVE scan on push/PR/weekly (security.yml) and
  as a hard gate in publish.yml — a vulnerable dep now blocks PyPI release
- detect-secrets: pre-commit hook to catch hard-coded credentials
- SECURITY.md: published security policy with private vulnerability reporting
- publish.yml: bumped checkout/setup-python to @v6 for consistency

Author: gregsvo

.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      minor-and-patch:
+        update-types: ["minor", "patch"]
+    open-pull-requests-limit: 5
+    labels: ["dependencies"]
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels: ["dependencies", "github-actions"]

.github/workflows/codeql.yml

@@ -0,0 +1,34 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze (python)
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: python
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:python"

.github/workflows/publish.yml

@@ -13,12 +13,25 @@ jobs:
       id-token: write  # required for OIDC trusted publishing
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
+      - name: Install Poetry
+        uses: snok/install-poetry@v1
+        with:
+          version: 2.4.1
+
+      - name: Export requirements
+        run: poetry export --without-hashes -f requirements.txt -o /tmp/requirements.txt
+
+      - name: Audit dependencies
+        uses: pypa/gh-action-pip-audit@v1.1.0
+        with:
+          inputs: /tmp/requirements.txt
+
       - name: Install build
         run: pip install build
 

.github/workflows/security.yml

@@ -0,0 +1,40 @@
+name: Security
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"
+
+jobs:
+  pip-audit:
+    name: Dependency Vulnerability Scan
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install Poetry
+        uses: snok/install-poetry@v1
+        with:
+          version: 2.4.1
+          virtualenvs-create: true
+          virtualenvs-in-project: true
+
+      - name: Install dependencies
+        run: poetry install --no-interaction --no-root
+
+      - name: Export requirements
+        run: poetry export --without-hashes -f requirements.txt -o /tmp/requirements.txt
+
+      - name: Run pip-audit
+        uses: pypa/gh-action-pip-audit@v1.1.0
+        with:
+          inputs: /tmp/requirements.txt

.pre-commit-config.yaml

@@ -46,3 +46,9 @@ repos:
       - id: bandit
         args: [-c, pyproject.toml]
         additional_dependencies: ["bandit[toml]"]
+
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: v1.5.0
+    hooks:
+      - id: detect-secrets
+        args: ["--baseline", ".secrets.baseline"]

.secrets.baseline

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ---
 
+## [0.3.6] - 2026-07-10
+
+### Added
+
+- Security hardening for the repository and release pipeline:
+  - **Dependabot** (`.github/dependabot.yml`): weekly automated PRs for Python dependency and GitHub Actions updates; minor and patch updates grouped to reduce noise.
+  - **CodeQL** (`.github/workflows/codeql.yml`): SAST scanning on every push, PR, and weekly schedule; results surface in the GitHub Security tab.
+  - **Dependency vulnerability scanning** (`.github/workflows/security.yml`): `pip-audit` checks all locked dependencies against OSV/PyPI advisory databases on push, PR, and weekly.
+  - **Publish gate** (`publish.yml`): `pip-audit` now runs before every PyPI release; a known-vulnerable dependency blocks the publish job.
+  - **Secret detection** (`.pre-commit-config.yaml`): `detect-secrets` pre-commit hook blocks commits containing hard-coded credentials.
+  - **`SECURITY.md`**: published security policy with private vulnerability reporting instructions and scope definition.
+
+---
+
 ## [0.3.5] - 2026-07-07
 
 ### Changed

CHANGELOG.md

@@ -0,0 +1,45 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+| ------- | --------- |
+| Latest  | Yes       |
+| Older   | No        |
+
+Only the latest published release receives security fixes. We recommend always pinning to the latest version.
+
+## Reporting a Vulnerability
+
+**Do not open a public GitHub issue for security vulnerabilities.**
+
+Use GitHub's private vulnerability reporting:
+
+1. Go to the [Security tab](https://github.com/ActiveCampaign/postmark-python/security)
+2. Click **"Report a vulnerability"**
+3. Fill in the details and submit
+
+You'll receive an acknowledgement within **48 hours** and a triage response within **7 days**.
+
+## Scope
+
+**In scope:**
+- Vulnerabilities in this SDK's Python code
+- Vulnerable transitive dependencies pulled in by this package
+
+**Out of scope:**
+- Bugs in the Postmark service or API itself — report those to [Postmark support](https://postmarkapp.com/support)
+- Issues requiring a compromised Postmark API token (treat tokens as secrets)
+- Vulnerabilities in your application code that happens to use this SDK
+
+## Responsible Disclosure
+
+We ask that you:
+- Give us reasonable time to fix the issue before public disclosure
+- Avoid accessing or modifying data belonging to other users
+- Not perform denial-of-service attacks
+
+We commit to:
+- Acknowledge your report promptly
+- Keep you informed of our progress
+- Credit you in the release notes (unless you prefer otherwise)

SECURITY.md

@@ -1,6 +1,6 @@
 [project]
 name = "postmark-python"
-version = "0.3.5"
+version = "0.3.6"
 description = "The Official Postmark Python SDK."
 authors = [
     { name = "Greg Svoboda", email = "gsvoboda@activecampaign.com" },