From cf234ef897713a47306ca51ee11de548948fc6af Mon Sep 17 00:00:00 2001
From: Julius Walton <juliuswalton7901@gmail.com>
Date: Thu, 4 Jun 2026 01:01:54 -0400
Subject: [PATCH] Add CodeQL scanning, Dependabot, and a security policy

- CodeQL JavaScript/TypeScript code scanning on push, PR, and a weekly schedule (actions pinned to SHA, least-privilege per-job permissions).
- Dependabot for npm and github-actions, weekly, grouped.
- SECURITY.md pointing reporters at private vulnerability reporting.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/dependabot.yml       | 19 +++++++++++++++++
 .github/workflows/codeql.yml | 41 ++++++++++++++++++++++++++++++++++++
 SECURITY.md                  | 26 +++++++++++++++++++++++
 3 files changed, 86 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/codeql.yml
 create mode 100644 SECURITY.md

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..e477679
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,19 @@
+version: 2
+updates:
+  # Dev dependencies (ESLint, Prettier, Vitest, etc.).
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      dev-dependencies:
+        patterns:
+          - "*"
+
+  # GitHub Actions used by the workflows (keeps the pinned SHAs current).
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..b0f7da0
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,41 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Weekly scan to catch advisories in code that hasn't changed.
+    - cron: "27 4 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      # Required for CodeQL to upload results to code scanning.
+      security-events: write
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript]
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@84498526a009a99c875e83ef4821a8ba52de7c22 # codeql-bundle-v2.25.5
+        with:
+          languages: ${{ matrix.language }}
+          # Static assets only; no compiled languages to build.
+          build-mode: none
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@84498526a009a99c875e83ef4821a8ba52de7c22 # codeql-bundle-v2.25.5
+        with:
+          category: "/language:${{ matrix.language }}"
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..d626ec3
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,26 @@
+# Security Policy
+
+## Supported versions
+
+Only the latest released version of the extension is supported. Please
+update before reporting an issue.
+
+## Reporting a vulnerability
+
+Please **do not** open a public issue for security problems.
+
+Instead, report privately via GitHub's
+[private vulnerability reporting](https://github.com/ShiosOS/github-pr-reverse-comments/security/advisories/new)
+("Report a vulnerability" under the **Security** tab). You can expect an
+initial response within a few days.
+
+## Scope
+
+This is a client-side browser extension. It requests only the `storage`
+permission and access to `github.com` pull request pages, stores a single
+local preference (`"newest"` or `"oldest"`), and makes no network requests.
+
+Relevant reports include, for example: a way for a malicious page to run
+code in the extension's context, exfiltrate the stored preference, or abuse
+the `github.com` host permission. Please include the affected version, the
+browser, and reproduction steps.