# Private Vulnerability Reporting — Setup Checklist

_Repository-recovery Tasks 06–07. This checklist separates repository-file work
(committable in a PR) from GitHub repository-settings work (changes live GitHub
state and requires its own explicit approval)._

## Part A — Repository files (Task 06, this PR)

- [x] Publish `SECURITY.md` at the repository root with:
  - [x] Supported versions.
  - [x] Private reporting path (GitHub "Report a vulnerability").
  - [x] Response expectations (best-effort).
  - [x] Coordinated disclosure policy.
  - [x] No-secret guidance.
- [x] Publish this checklist.

These are file changes only. They do **not** enable the private reporting
feature — they document how to use it once enabled.

## Part B — GitHub repository settings (Task 07, separate approval)

> ⚠️ The following change live GitHub state, not files. Each requires explicit
> approval immediately before it is made, and is verified by read-back.

- [x] Enable **Private vulnerability reporting** _(done 2026-07-15)_
  - Settings → Code security and analysis → Private vulnerability reporting → Enable.
  - API: `PUT /repos/{owner}/{repo}/private-vulnerability-reporting`.
  - Read-back: `GET /repos/{owner}/{repo}/private-vulnerability-reporting` shows `enabled: true`. ✅
- [x] Confirm the **Security** tab now offers "Report a vulnerability" so the
      path documented in `SECURITY.md` is live. ✅
- [x] Record evidence in
      `docs/maintenance/repository-recovery/private-vulnerability-reporting-evidence.md`. ✅
- [x] **Dependency Graph** enabled (prerequisite discovered in Task 08 —
      `dependency-review.yml` requires it). `PUT /repos/{owner}/{repo}/vulnerability-alerts`,
      read-back `HTTP 204`. ✅

## Notes

- `SECURITY.md` references the private reporting path before Part B is applied.
  There is a brief window where the documented path is not yet live; Part B
  should follow promptly.
- No other repository setting is changed as part of Part B — only private
  vulnerability reporting.