From abdc8cd35548a6e191a084adabfe3a69632f91ee Mon Sep 17 00:00:00 2001
From: BillyOutlast <172061051+BillyOutlast@users.noreply.github.com>
Date: Mon, 14 Sep 2026 19:36:05 -0400
Subject: [PATCH] chore: add SECURITY.md and Dependabot config

Add a private vulnerability-reporting policy and weekly Dependabot updates
(npm/cargo as applicable + GitHub Actions) to satisfy the org security-posture
baseline.

Refs Heretek-Games/drop#69
---
 .github/dependabot.yml | 12 ++++++++++++
 SECURITY.md            | 16 ++++++++++++++++
 2 files changed, 28 insertions(+)
 create mode 100644 .github/dependabot.yml
 create mode 100644 SECURITY.md

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..0e0cacc
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..3b22322
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,16 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security issues **privately** using GitHub's private
+vulnerability reporting on this repository (**Security → Report a
+vulnerability**). Do not open a public issue for a security problem.
+
+Include a description, the affected version or commit, reproduction steps, and
+the impact. We aim to acknowledge reports within a few business days.
+
+## Scope
+
+This repository is part of the [Heretek Games](https://github.com/Heretek-Games)
+workspace. See [`drop`'s SECURITY.md](https://github.com/Heretek-Games/drop/blob/develop/SECURITY.md)
+for the platform-wide policy.