[hhvrc]

files

• add SECURITY.md
• add .github/CODEOWNERS

Generated by org-sync from the org-wide desired state.

Summary by CodeRabbit

• Documentation
  • Added a security policy with guidance for private vulnerability reporting, disclosure timelines, and supported-version security updates.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

The pull request adds security policy documentation and assigns repository owners through CODEOWNERS.

Changes: Security governance

Layer / File(s)	Summary
Security reporting policy SECURITY.md	Documents private vulnerability reporting options, acknowledgement and triage timelines, coordinated disclosure, bounty and credit information, and the latest-release security fix rule.
Repository ownership rules .github/CODEOWNERS	Assigns two owners to all paths, SECURITY.md, and .github paths. Adds a note that owners need repository write access for GitHub to honor the rules.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: Minimal · up to cd7e9

This change adds a security policy and code ownership rules. It has no runtime effect and no merge-blocking risk is evident.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "chore: sync with org-wide desired state" does not name the changes. The PR adds SECURITY.md and .github/CODEOWNERS, which are generated from the organization-wide desired state via org-sync…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "chore: sync with org-wide desired state" does not name the changes. The PR adds SECURITY.md and .github/CODEOWNERS, which are generated from the organization-wide desired state via org-sync. The title is partially related: it names the source of the change, but it does not say that a security policy and code owners were added. It is also not vague, because it describes a real sync operation.

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4ad8016e-e843-4976-80f8-d2514938460b

Commits

Reviewing files that changed from the base of the PR and between 4d971b0 and cd7e993.

Files selected for processing: 2

• .github/CODEOWNERS
• SECURITY.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

[github-actions]

Change file check

⚠️ Missing: this PR does not add a change file under .changes/.

If this change should show up in the release notes, add one with release-tool new "<title>" --kind <added|changed|deprecated|removed|fixed|security|safety|chore>. Otherwise add the no-changelog label.