docs: add a security policy

[jd]

SECURITY.md tells reporters to use Mergify's HackerOne program rather than
a public issue, gives security@mergify.com for other security questions and
links the vulnerability disclosure policy on docs.mergify.com: the same
places mergify.com/.well-known/security.txt points to. GitHub shows it in
the repository's Security tab.

AGENTS.md lists SECURITY.md with what this repository owns.

Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com

[mergify]

Merge Protections

🟢 All 6 merge protections satisfied — ready to merge.

Show 6 satisfied protections

🟢 🤖 Continuous Integration

• all of:
  • check-success=ci-gate

🟢 👀 Review Requirements

• any of:
  • #approved-reviews-by>=1
  • author = dependabot[bot]
  • author = mergify-ci-bot
  • author = renovate[bot]

🟢 Enforce conventional commit

Make sure that we follow https://www.conventionalcommits.org/en/v1.0.0/

• title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:

🟢 🔎 Reviews

• #changes-requested-reviews-by = 0
• #review-requested = 0
• #review-threads-unresolved = 0

🟢 📕 PR description

• body ~= (?ms:.{48,})

🟢 🚦 Auto-queue

When all merge protections are satisfied, this pull request will be queued automatically.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[jd]

Revision history

#	Type	Changes	Reason	Date
1	initial	e02633b		2026-10-18 14:22 UTC
2	content	e02633b → fd1e164	drop the Scorecard and CodeQL workflows: keep only the security policy	2026-10-18 14:22 UTC

[jd]

Simplified: the Scorecard and CodeQL workflows are gone. This repository now publishes only the skills, the plugin manifests and install.sh, so running either one here would cost more than it would tell us. What's left is SECURITY.md (HackerOne, security@, the disclosure policy) and the matching line in AGENTS.md. Commit retitled to docs: add a security policy.

https://github.com/Mergifyio/mergify-cli/compare/e02633bce8c02553bcfb91ca582ffdda40a951a4..fd1e164421667f7de0b7afff49bea84793a5426a

[mergify]

Merge Queue Status

• ✅ Entered queue — 2026-10-19 12:59 UTC · Rule: default · triggered by merge protections
• ✅ Checks skipped · PR is already up-to-date
• ✅ Merged — 2026-10-19 12:59 UTC · at 295befaa6f2a641fdf43f50f387b50f3057a9ef2 · squash

This pull request spent 22 seconds in the queue, including 2 seconds running CI.

Required conditions to merge

• github-review-approved [🛡 GitHub branch protection]
  • docs: add a security policy #1902
• github-review-approved [🛡 GitHub repository ruleset rule Require pull request for default branch]
  • docs: add a security policy #1902
• all of [🛡 Merge Protections rule Enforce conventional commit]:
  • title ~= ^(fix|feat|internal|docs|style|refactor|perf|test|build|ci|chore|revert|ui)(?:\(.+\))?!?:
    • docs: add a security policy #1902
• all of [🛡 Merge Protections rule 👀 Review Requirements]:
  • any of:
    • #approved-reviews-by>=1
      • docs: add a security policy #1902
    • author = dependabot[bot]
      • docs: add a security policy #1902
    • author = mergify-ci-bot
      • docs: add a security policy #1902
    • author = renovate[bot]
      • docs: add a security policy #1902
• all of [🛡 Merge Protections rule 📕 PR description]:
  • body ~= (?ms:.{48,})
    • docs: add a security policy #1902
• all of [🛡 Merge Protections rule 🔎 Reviews]:
  • #changes-requested-reviews-by = 0
    • docs: add a security policy #1902
  • #review-requested = 0
    • docs: add a security policy #1902
  • #review-threads-unresolved = 0
    • docs: add a security policy #1902
• all of [🛡 Merge Protections rule 🤖 Continuous Integration]:
  • all of:
    • check-success=ci-gate