From fe36893c32405b36adc716a80cfb44019572c39d Mon Sep 17 00:00:00 2001
From: ZyntroAI Bot <bot@zyntro.ai>
Date: Wed, 9 Sep 2026 06:44:47 +0000
Subject: [PATCH] docs: fill SECURITY.md policy + add default PR template

- SECURITY.md: replace unfilled GitHub boilerplate with a real policy
  (supported versions, private-advisory reporting flow, expected-response
  SLA by severity, repo security practices).
- .github/PULL_REQUEST_TEMPLATE.md: default PR template for general changes,
  pointing typed changes to the 6 specialized templates in PULL_REQUEST_TEMPLATE/.
---
 .github/PULL_REQUEST_TEMPLATE.md | 56 ++++++++++++++++++++++++++++++++
 SECURITY.md                      | 53 +++++++++++++++++++++++-------
 2 files changed, 97 insertions(+), 12 deletions(-)
 create mode 100644 .github/PULL_REQUEST_TEMPLATE.md

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..63d0982
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,56 @@
+---
+name: Default
+about: General change (backend, frontend, knowledge, infra)
+title: ""
+labels: ""
+assignees: ""
+---
+
+## Summary
+
+<!-- What is changing and why? One clear paragraph. -->
+
+## Type of change
+
+- [ ] ✨ Feature (new capability)
+- [ ] 🐛 Bugfix (fixes a defect)
+- [ ] 🔒 Security (vulnerability / hardening)
+- [ ] ⚙️ Configuration / Infra / CI
+- [ ] 📚 Documentation
+- [ ] 📦 Dependency
+- [ ] 🚀 Release
+
+> **Specialized template?** If your change is primarily **Security**, a
+> **Release**, **Configuration/Infra**, **Documentation**, **Dependency** or a
+> **Bugfix**, please use the matching typed template in
+> [`.github/PULL_REQUEST_TEMPLATE/`](./PULL_REQUEST_TEMPLATE/) instead — each
+> carries the checks the PR-quality CI expects for that type.
+
+## Scope
+
+- [ ] Backend (`backend/`)
+- [ ] Frontend (`frontend/`)
+- [ ] Knowledge / docs (`knowledge/`, docs)
+- [ ] Infra / CI (`k8s/`, `.github/workflows/`)
+- [ ] Other: _____
+
+## What changed
+
+<!-- Bullet list of the concrete changes. -->
+
+## How tested
+
+- [ ] Lint passes (ruff / eslint)
+- [ ] Tests pass (pytest / vitest)
+- [ ] Manual verification
+
+```
+(paste test / verification output)
+```
+
+## Checklist
+
+- [ ] No secrets committed
+- [ ] No unrelated changes bundled
+- [ ] Existing files not clobbered (additive where appropriate)
+- [ ] Changes are minimal and targeted
diff --git a/SECURITY.md b/SECURITY.md
index 034e848..ba328a7 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,21 +1,50 @@
 # Security Policy
 
+ZyntroAI treats security vulnerabilities seriously. This document covers which
+versions are supported and how to report a vulnerability privately.
+
 ## Supported Versions
 
-Use this section to tell people about which versions of your project are
-currently being supported with security updates.
+Only the current release line receives security patches. Older lines are
+supported on a best-effort basis.
 
-| Version | Supported          |
-| ------- | ------------------ |
-| 5.1.x   | :white_check_mark: |
-| 5.0.x   | :x:                |
-| 4.0.x   | :white_check_mark: |
-| < 4.0   | :x:                |
+| Version          | Supported          |
+| ---------------- | ------------------ |
+| latest (main)    | :white_check_mark: |
+| < latest         | :x:                |
 
 ## Reporting a Vulnerability
 
-Use this section to tell people how to report a vulnerability.
+**Do not open a public GitHub issue for security problems.**
+
+Instead, report privately so the issue can be assessed and patched before it
+is disclosed:
+
+- **Preferred:** Open a [private security advisory][advisories] on GitHub.
+- **Fallback:** Email the maintainer directly if you cannot use the advisory
+  flow. (Link the relevant repository and include a minimal reproduction.)
+
+### What to expect
+
+1. **Acknowledgment** within **48 hours** of your report.
+2. **Triage** — we confirm the issue, scope its impact, and assign severity.
+3. **Fix** — we develop and ship a patch. Timeline depends on severity:
+   - **Critical / High**: patch as soon as possible (target within days).
+   - **Medium / Low**: scheduled with the next release.
+4. **Disclosure** — we coordinate public disclosure after the fix ships so
+   users can upgrade before details go public.
+
+If a report is declined (not a vulnerability, or out of scope), we explain why
+and close it with that reasoning. We request that reporters allow time for a
+patch before public disclosure.
+
+## Security practices in this repo
+
+- Secrets never ship in source or config — use environment variables / CI
+  secrets only (see `.env.example` for the shape).
+- External-service failures fail **open** (graceful degradation), never leak
+  state.
+- CI runs secret scanning and static analysis on PRs before merge.
+- Dependencies are kept current; security advisories are triaged promptly.
 
-Tell them where to go, how often they can expect to get an update on a
-reported vulnerability, what to expect if the vulnerability is accepted or
-declined, etc.
+[advisories]: https://github.com/ZyntroAI/fastapi-python-boilerplate/security/advisories