feat(security): add a finder-credit policy — timing gate and no placeholders

[potiuk]

Summary

The framework has no answer to "does this report earn a finder credit at all?". bot-credits-policy.md decides what category a credited party belongs to; nothing decides whether the credit is earned, and nothing says how to represent the absence of a finder.

Adds tools/cve-tool-vulnogram/finder-credit-policy.md as its sibling, with two rules.

Rule 1 — timing. No finder credit when a public fix PR for the same issue was already opened before the report arrived. The bar is opened, not merged: an open PR's diff, title and touched code path are readable by anyone, so a later report is not telling the project something it did not already know. Two authoritative timestamps decide it (gh pr view --json createdAt, the inbound Date: header) — never the reporter's prose. Four exceptions: the original finder, a genuinely different prong, a credit already offered in writing, a credit already published.

Rule 2 — no placeholders. Where there is no named finder, omit the finder credit rather than writing anonymous. An empty field makes the generator emit no finder entry, which is the correct record — a credits[] carrying only the remediation developer is normal and complete. Rule 2 governs only the finder row; a tool that made the discovery is still credited type: "tool".

Motivation

Both rules come from a downstream adopter that hit the failure modes directly. Rule 1's written-offer exception is the load-bearing one: that adopter credited a duplicate reporter, then had to retract it once the rule was drawn. Applying the gate at intake — before any offer is made — is what stops the retraction being necessary.

Rule 2 comes from an ASF CVE reviewer's feedback on a published batch: "I'm not sure how helpful it is to credit 'anonymous' as finder, just leave it out."

Relationship to #1124

#1124 (open) makes anonymous the fallback when a scanner declares no public credit name. Rule 2 supersedes that fallback — the right end state is to omit the finder row, not write a placeholder. Rather than growing #1124's scope after review, I'll rebase this branch once #1124 merges and change that one fallback phrase to match. Flagging it so a reviewer seeing both doesn't read it as a contradiction.

Scope

Wired into the two skills that actually write the field — security-issue-import (intake) and security-issue-sync (reconciliation) — and cross-referenced from bot-credits-policy.md. security-cve-allocate and security-issue-deduplicate appear in the policy's applies-to list but aren't edited: neither writes credits[] directly.

Test plan

prek run --files passes on all four files — markdownlint, typos, check-placeholders, skill-and-tool-validate, doctoc, SPDX stamping, and the in-hook lychee. The new doc uses only <upstream> / <N> placeholders (no project identity), which check-placeholders verifies. The worked example is fully anonymised.

🤖 Generated with Claude Code