From 6ab92aa47536b6ad7b798f222e332e96b3973997 Mon Sep 17 00:00:00 2001
From: Theauxm <43664045+Theauxm@users.noreply.github.com>
Date: Thu, 2 Jul 2026 12:48:26 -0600
Subject: [PATCH] chore: add a security policy and Dependabot

Add SECURITY.md with a private vulnerability-reporting policy, and a Dependabot config
that keeps NuGet, GitHub Actions, and npm dependencies patched. Together with the build's
vulnerability-audit gate, advisories now get both flagged and fixed.
---
 .github/dependabot.yml | 18 ++++++++++++++++++
 SECURITY.md            | 15 +++++++++++++++
 2 files changed, 33 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 SECURITY.md

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..f790db9
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: "nuget"
+    directory: "/"
+    schedule: { interval: "weekly" }
+    open-pull-requests-limit: 10
+    groups:
+      nuget-dependencies: { patterns: ["*"] }
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule: { interval: "weekly" }
+    groups:
+      actions: { patterns: ["*"] }
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule: { interval: "weekly" }
+    groups:
+      npm-dependencies: { patterns: ["*"] }
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..12e0ec9
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,15 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Report security issues privately through GitHub's [private vulnerability reporting](https://github.com/TraxSharp/Trax.Core/security/advisories/new), not a public issue. We aim to acknowledge within 3 business days.
+
+Where possible, include the affected package and version, a description, reproduction steps or a proof of concept, and the impact.
+
+## Supported versions
+
+Fixes ship against the latest version published to NuGet. Older major versions are not backported.
+
+## Supply-chain posture
+
+Trax builds and publishes through a defense-in-depth pipeline: SHA-pinned actions, isolated release credentials, OIDC trusted publishing with SLSA provenance, and locked + audited dependencies (a known-vulnerability advisory fails the build). See the [Supply Chain Security](https://traxsharp.net/docs/supply-chain-security) guide.