[rmcdaniel]

Change

Document the existing GitHub private vulnerability-reporting path in the default security policy. Preserve the security-maintainer statement verbatim.

The settings audit found private reporting disabled on all 11 public repositories. It is now enabled on all 11, with an independent API readback for each. Anonymous HTTP readback also confirms a Report a vulnerability entry on every public Advisories page. No report was submitted and no paid feature was enabled.

Verification

• Reviewed the small Markdown diff and git diff --check.
• All three candidate checks pass: shared contracts, SonarQube workflow and the SonarCloud app check.
• API settings and public reporting-button checks pass on all 11 repositories.
• Merged as 7b3eb7f00e8779fcf3802d7e3a14321020f554ff, with the identical reviewed tree b95aa7ea6a652f1c8efdc76becbf66d29c222991.
• All three independent main checks pass: repository39277229309, SonarQube39277229313 and the app check.
• Anonymous readback confirms the reporting directions on all 11 inherited Security policy pages. The original maintainer section is byte-identical.

Closes #208.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud