Summary

Add a root SECURITY.md so the project has a published security policy: how to report a vulnerability privately, which versions are supported, what response to expect, and how coordinated disclosure works. GitHub surfaces it as the repository's security policy, and it satisfies the OpenSSF Scorecard Security-Policy check.

Type of change

• Documentation

Changes

• Add SECURITY.md at the repository root (a location GitHub recognizes, alongside README.md / CONTRIBUTING.md), covering:
  • Supported versions — security updates target the latest stable release.
  • Reporting a vulnerability — private reporting via GitHub security advisories (no public issues/PRs), with the information to include.
  • What to expect — acknowledgement and assessment timelines, and coordinated disclosure within 90 days when reasonable.
  • Scope — what does and does not qualify as a security vulnerability.
  • Disclosure process and recognition of reporters (no paid bounty program).

Testing

• dotnet build FirstClassErrors.sln
• dotnet test FirstClassErrors.sln
• Analyzer tests pass (FirstClassErrors.Analyzers.UnitTests)

Not applicable — a single documentation file is added; no source is touched.

Documentation

• No documentation change required — SECURITY.md is a repository policy file, not part of the library's user documentation under doc/, so no README or doc/ change is needed.

Related issues