[byapparov]

No linked issue. This documentation change contributes to the disclosure-policy item in #245; that broader adoption issue remains open.

Intent

Give people who find a suspected aictrl CLI vulnerability a private reporting route. GitHub private vulnerability reporting is already enabled, but the repository has no security policy describing it.

Expected Impact on Users

People who discover a suspected CLI vulnerability can find the existing private GitHub reporting form and the reproduction details maintainers need, reducing the chance of exploit details or credentials being posted in public issues. Ordinary bugs continue to use the public tracker. This documentation adds no runtime protection, response-time commitment or bounty promise.

Expected Outcomes

• The repository security policy links the existing private reporting form.
• Reports request the affected version, reproduction, impact and sanitized examples.

Implementation

Add root SECURITY.md with the reporting route and minimal report guidance.

Scope Caveat

This is reporting documentation only. It does not resolve the other items in #245, change runtime permissions or isolation, or introduce support-version, response-time or bounty promises.

Test Plan

• Verify private vulnerability reporting is enabled for this repository and compare the route with GitHub's documented mechanism.
• Independently review the exact policy text and confirm this is a one-file documentation change.
• Check whitespace and confirm committed text matches the reviewed candidate.
• Complete this revision's hosted CI and CodeQL checks.
• Finish the original automated review observation window: six scheduled polls completed on 21 October at 08:23 UTC.

Verification

• GitHub API private-reporting check — enabled: true; no disclosure form was submitted.
• Exact committed policy and independent documentation review — match; no actionable findings.
• Frozen-lock installation, Husky preparation and normal local commit — succeeded without hook bypass.
• CI run 39565232900 — passed: 1,829 tests, 6 skipped, 0 failed; uncached build and typecheck succeeded. The actual merge checkout matches this one-file commit.
• CodeQL run 39565229435 — both exact-head analyses and the aggregate check passed, with zero analysis/SARIF findings and no applicable open alerts.
• Automated review observation — all six scheduled polls completed with no reviews or comments; the monitor exited successfully. Absence of feedback is not reviewer approval.

Automated Review

The ready-for-review event triggered aictrl-bot on this exact head. Its check completed successfully with one documentation NIT: a supported-version table is absent. The reporting route is correct and accepts reports without a version exclusion; the reviewed repository establishes no maintenance window to put in a table. The observation was recorded as TRUE / IGNORE, with no code changes or new support commitments. Verified response and verdict sidecar; exact recorded verdict was persisted and read back. This is review triage, not approval to merge or release.

[aictrl-dev]

⚪ SECURITY.md lacks a supported-versions/scope section.

🤖 Fix with your agent

Fix this code review finding (aictrl-dev/cli PR #258, SECURITY.md:3):

Problem: SECURITY.md lacks a supported-versions/scope section
Detail: The policy tells reporters what to include but not which CLI versions are currently supported, so reporters cannot tell whether an unsupported release is in scope. GitHub's standard SECURITY.md template pairs the reporting channel with a Supported Versions table. Everything security-relevant in the file (private-channel URL, org/repo links, sanitization guidance) is correct.
Suggested fix: Add a short "## Supported versions" section (e.g. a | Version | Supported | table listing the latest release as supported and older releases as best-effort, or the actual support window) so reporters know which versions are in scope.

Implement the fix on the PR head branch and add a regression test that fails before the fix and passes after.

Why this matters

The policy tells reporters what to include but not which CLI versions are currently supported, so reporters cannot tell whether an unsupported release is in scope. GitHub's standard SECURITY.md template pairs the reporting channel with a Supported Versions table. Everything security-relevant in the file (private-channel URL, org/repo links, sanitization guidance) is correct.

# Security policy

## Report a vulnerability

Report suspected vulnerabilities in aictrl CLI through [GitHub private vulnerability reporting](https://github.com/aictrl-dev/cli/security/advisories/new). You can also open this repository's Security and quality tab and choose **Report a vulnerability**.

Please include:

[aictrl-dev]

Code review

Verdict: Looks good — only minor / nit comments below. · 🔴 0 · 🟠 0 · 🟡 0 · ⚪ 1 · 0/1 resolved

• ⚪ SECURITY.md:3 — SECURITY.md lacks a supported-versions/scope section

🤖 Fix all 1 open findings with your agent

Fix the following code review findings on aictrl-dev/cli PR #258 (head branch).
Run the relevant tests/linters after each change.

1. SECURITY.md:3 — SECURITY.md lacks a supported-versions/scope section
   Detail: The policy tells reporters what to include but not which CLI versions are currently supported, so reporters cannot tell whether an unsupported release is in scope. GitHub's standard SECURITY.md template pairs the reporting channel with a Supported Versions table. Everything security-relevant in the file (private-channel URL, org/repo links, sanitization guidance) is correct.
   Suggested fix: Add a short "## Supported versions" section (e.g. a | Version | Supported | table listing the latest release as supported and older releases as best-effort, or the actual support window) so reporters know which versions are in scope.

📋 Out-of-diff findings (1)

Sev	Location	Finding
⚪	SECURITY.md:3	SECURITY.md lacks a supported-versions/scope section

Reviewed 1 files · 0 inline · view all 1 findings ↗ · AI-generated — verify findings before acting · AI guidance and feedback

---

aictrl · AI code review for fast-moving teams · aictrl.dev

[byapparov]

Review response — PR #258

Reviewed the reporting-only policy at f5759022f08f1c1388a22fb0d1cd17dfaaadaeb7.

Issues addressed (pushed to this PR)

None; no source change is needed for this documentation nit.

Review claims verified false (no change needed)

None.

Not addressed here

• Supported-version table — the section is absent, so the observation is TRUE. The bot records it as NIT. The policy already invites reports about aictrl CLI and requests the affected version without excluding older versions. The reviewed README, release guidance and repository policy define no maintenance window. Listing a current release as supported or older releases as best-effort would introduce a support commitment that this reporting-only change does not establish. Leave the optional table out; no runtime/security fix or regression test is warranted.

The parser normalizes this security-policy wording to SECURITY; the platform's recorded severity is NIT. The exact recorded finding is uniquely identified by its location, full claim and normalized severity; no comment-ID match is asserted because its recorded githubCommentId is null.