From bea7b21933d28ee4e18d0081634dc0fc128fdd87 Mon Sep 17 00:00:00 2001
From: Leandro Rocha <59700137+leandroer@users.noreply.github.com>
Date: Tue, 29 Sep 2026 11:09:04 -0400
Subject: [PATCH 1/4] Add repository security baseline

---
 SECURITY.md | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..92b80d4
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,22 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please do not disclose suspected vulnerabilities in a public issue.
+
+Use GitHub's private vulnerability reporting feature when it is available. Otherwise, contact the repository owner through the contact method listed on the GitHub profile and include:
+
+- the affected file or component
+- steps to reproduce the issue
+- the potential impact
+- any suggested remediation
+
+Do not include active credentials, personal data, or exploit payloads beyond what is necessary to reproduce the issue.
+
+## Supported versions
+
+The default branch is the supported version. Security fixes are applied there first.
+
+## Responsible testing
+
+Test only against systems and data you own or are explicitly authorized to assess.

From 575faa072d19ffb6048381106360b5d1ee0406eb Mon Sep 17 00:00:00 2001
From: Leandro Rocha <59700137+leandroer@users.noreply.github.com>
Date: Tue, 29 Sep 2026 11:09:35 -0400
Subject: [PATCH 2/4] Add repository ownership rules

---
 .github/CODEOWNERS | 5 +++++
 1 file changed, 5 insertions(+)
 create mode 100644 .github/CODEOWNERS

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..8005102
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,5 @@
+# Repository-wide ownership
+* @leandroer
+
+# Security-sensitive automation
+/.github/ @leandroer

From 7b001c9786177064621240a205324c69574cffb6 Mon Sep 17 00:00:00 2001
From: Leandro Rocha <59700137+leandroer@users.noreply.github.com>
Date: Tue, 29 Sep 2026 11:09:40 -0400
Subject: [PATCH 3/4] Enable dependency updates

---
 .github/dependabot.yml | 10 ++++++++++
 1 file changed, 10 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..00c2dfb
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

From c1ef983a05de9728683072f7a0b6c2956784c0c0 Mon Sep 17 00:00:00 2001
From: Leandro Rocha <59700137+leandroer@users.noreply.github.com>
Date: Tue, 29 Sep 2026 11:09:46 -0400
Subject: [PATCH 4/4] Pin workflow actions to immutable commits

---
 .github/workflows/content-validation.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/content-validation.yml b/.github/workflows/content-validation.yml
index d00deaf..25c5917 100644
--- a/.github/workflows/content-validation.yml
+++ b/.github/workflows/content-validation.yml
@@ -12,8 +12,8 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with: {python-version: "3.12"}
       - run: python -m pip install --disable-pip-version-check -r requirements-dev.txt
       - run: python scripts/validate_rules.py