docs: add a security policy

[itzzdev09]

Addresses the second half of #1051.

Why

There's no SECURITY.md in any of the three locations GitHub reads (/, .github/, docs/), so the repo has no Security policy link and no documented private channel. As #1051 puts it, a reporter is left choosing between a public issue, Discord, or the general inbox — an awkward gap for a security tool.

What's here

A SECURITY.md pointing at GitHub private vulnerability reporting (primary) and hi@usestrix.com (fallback), plus what to include, scope, and disclosure expectations.

Two parts are written for this project specifically rather than boilerplate:

Scope is framed around the boundary that actually matters here. Strix runs untrusted target content through an agent and writes artifacts a human later opens, so it calls out sandbox escape, exposure of LLM keys / proxy-captured credentials / the MITM CA key, injection reached through the generated reports (CSV, Markdown, PDF, SARIF, JSON), and prompt injection escalating outside the sandbox.

It states the non-scope explicitly — findings Strix reports about a user's own scan target aren't vulnerabilities in Strix, and neither is scanning a host you're not authorised to test. For a pentesting tool that distinction seems worth writing down, or the inbox fills with scan output.

It also asks reporters to redact scan artifacts before sending, since a run directory can carry target hostnames and captured credentials.

Two things for you to decide

Response timelines. I deliberately did not write any — an acknowledgement window or fix SLA is a commitment only maintainers can make, and inventing numbers seemed worse than omitting them. Happy to add whatever you want to promise.

Supported versions. I wrote that fixes land on the latest release rather than being backported, which matches the current cadence (v1.4.1 → v1.5.3 inside a month). Correct that if the intent differs.

The other half of #1051 — enabling private vulnerability reporting under Settings → Code security — is a repo setting a PR can't touch. The policy links to the Security tab on the assumption it'll be enabled; if you'd rather not, say so and I'll drop that channel and leave email only.

Verified

Every factual claim was checked rather than assumed: hi@usestrix.com is the public org email, the Security tab URL returns 200, --version is a real flag in cli_args.py, and the components named all exist (report/sarif.py, interface/viewer/report_pdf.py, containers/).

---

Disclosure: drafted with AI assistance (Claude Code).

[greptile-apps]

Greptile Summary

Adds a repository security policy that documents private reporting channels, requested report details, project-specific vulnerability scope, supported-version expectations, and coordinated disclosure guidance.

• Directs reporters to GitHub private vulnerability reporting with email as a fallback.
• Warns reporters to redact sensitive scan artifacts.
• Distinguishes vulnerabilities in Strix from findings against users’ scan targets.

Confidence Score: 5/5

The PR appears safe to merge as a documentation-only addition with no actionable defects.

The policy provides a private email fallback even while GitHub private vulnerability reporting depends on a separately acknowledged repository setting.

Important Files Changed

Filename	Overview
SECURITY.md	Adds clear, project-specific vulnerability reporting and disclosure guidance with no actionable defects found.

_{Reviews (1): Last reviewed commit: "docs: add a security policy" | Re-trigger Greptile}