init

.github/SECURITY.md

@@ -0,0 +1,34 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+**Do NOT open a public issue for security vulnerabilities.**
+
+Instead, please email **hi@santifer.io** with:
+
+1. Description of the vulnerability
+2. Steps to reproduce
+3. Potential impact
+4. Suggested fix (if any)
+
+You will receive a response within 72 hours. We will work with you to understand and address the issue before any public disclosure.
+
+## Scope
+
+Security issues in the following are in scope:
+
+- **Scripts** (`*.mjs`) — command injection, path traversal, SSRF
+- **Dashboard** (`dashboard/`) — any Go binary vulnerabilities
+- **Templates** (`templates/`) — XSS in generated HTML/PDF
+- **Configuration** — secrets exposure, unsafe defaults
+
+## Out of Scope
+
+- Issues in third-party dependencies (report upstream)
+- Issues requiring physical access to the user's machine
+- Social engineering attacks
+- career-ops is a local tool — there is no hosted service to attack
+
+## Disclosure Policy
+
+We follow coordinated disclosure. Once a fix is released, we will credit the reporter (unless they prefer anonymity) in the release notes.