Harden repository security baseline

.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# Repository-wide ownership
+* @leandroer
+
+# Security-sensitive automation
+/.github/ @leandroer

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/content-validation.yml

@@ -12,8 +12,8 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with: {python-version: "3.12"}
       - run: python -m pip install --disable-pip-version-check -r requirements-dev.txt
       - run: python scripts/validate_rules.py

SECURITY.md

@@ -0,0 +1,22 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please do not disclose suspected vulnerabilities in a public issue.
+
+Use GitHub's private vulnerability reporting feature when it is available. Otherwise, contact the repository owner through the contact method listed on the GitHub profile and include:
+
+- the affected file or component
+- steps to reproduce the issue
+- the potential impact
+- any suggested remediation
+
+Do not include active credentials, personal data, or exploit payloads beyond what is necessary to reproduce the issue.
+
+## Supported versions
+
+The default branch is the supported version. Security fixes are applied there first.
+
+## Responsible testing
+
+Test only against systems and data you own or are explicitly authorized to assess.