Create SECURITY.md

[hym-infy]

This pull request introduces a SECURITY.md file to the repository to establish a clear and responsible security vulnerability disclosure process.

Adding this file helps improve the project's security posture, aligns with open-source best practices, and enables responsible coordination between maintainers and security researchers.

Summary by CodeRabbit

• Documentation
  • Added security policy detailing procedures for reporting vulnerabilities and expected response timelines from maintainers during the disclosure process.

[coderabbitai]

Walkthrough

A new SECURITY.md file is added containing security policy documentation. It establishes a process for reporting security issues and describes how the maintainers handle and respond to vulnerability reports.

Changes

Cohort / File(s)	Summary
Security Policy Documentation SECURITY.md	New file establishing security issue reporting procedures and maintainer response commitments.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰✨ A bunny hops with joy today,
Security's now on display!
Our policies are clear and bright,
To keep the code forever right!
Report with care, we'll help you thrive! 🛡️

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Create SECURITY.md' accurately describes the main change—adding a new SECURITY.md file to establish a security vulnerability disclosure process.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

SECURITY.md (1)

5-5: Consider adding explicit response timelines (instead of “quickly”).

A concrete SLA (e.g., initial acknowledgement within 72 hours, periodic updates weekly) makes expectations clear for reporters.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@SECURITY.md` at line 5, Replace the vague phrase "We'll endeavor to respond
quickly and will keep you updated throughout the process." in SECURITY.md with
an explicit SLA sentence specifying response timelines (e.g., "We will
acknowledge reports within 72 hours and provide status updates at least weekly
until resolution") and optionally state escalation/contact expectations; update
the same paragraph to include those concrete intervals (acknowledgement
timeframe and periodic update cadence) so reporters have clear expectations.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@SECURITY.md`:
- Line 3: Replace the placeholder "To Update Mosip security URL" in SECURITY.md
with a real, clickable disclosure channel (e.g., a fully qualified HTTPS URL to
your security policy/bug-bounty page or a mailto:security@yourdomain.com link)
so the document is actionable; update the text where the placeholder appears
(search for the exact string "To Update Mosip security URL") and ensure the link
is formatted as a proper Markdown link and points to the official contact/PGP
key or policy page.

---

Nitpick comments:
In `@SECURITY.md`:
- Line 5: Replace the vague phrase "We'll endeavor to respond quickly and will
keep you updated throughout the process." in SECURITY.md with an explicit SLA
sentence specifying response timelines (e.g., "We will acknowledge reports
within 72 hours and provide status updates at least weekly until resolution")
and optionally state escalation/contact expectations; update the same paragraph
to include those concrete intervals (acknowledgement timeframe and periodic
update cadence) so reporters have clear expectations.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: b7acbecd-2b85-407e-aee5-5de6aea4e3e2

📥 Commits

Reviewing files that changed from the base of the PR and between aa6abf3 and 6ed9a02.

📒 Files selected for processing (1)

• SECURITY.md

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Replace placeholder reporting instructions with a real, clickable disclosure channel.

Line 3 still has placeholder text, so the policy is not actionable. This should be completed before merge.

Proposed fix

-The Mosip team and community take security issues seriously. To report a security issue, please go through the information mentioned [To Update Mosip security URL].
+The Mosip team and community take security issues seriously. To report a security issue, please use our official disclosure channel: [MOSIP Security Reporting](https://<official-security-reporting-url>).

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	The Mosip team and community take security issues seriously. To report a security issue, please go through the information mentioned [To Update Mosip security URL].
	The Mosip team and community take security issues seriously. To report a security issue, please use our official disclosure channel: [MOSIP Security Reporting](https://<official-security-reporting-url>).

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@SECURITY.md` at line 3, Replace the placeholder "To Update Mosip security
URL" in SECURITY.md with a real, clickable disclosure channel (e.g., a fully
qualified HTTPS URL to your security policy/bug-bounty page or a
mailto:security@yourdomain.com link) so the document is actionable; update the
text where the placeholder appears (search for the exact string "To Update Mosip
security URL") and ensure the link is formatted as a proper Markdown link and
points to the official contact/PGP key or policy page.