From 0750f8fa2caca00ce590b89011d7c937caed31e5 Mon Sep 17 00:00:00 2001
From: Jason Karns <jason@testdouble.com>
Date: Mon, 27 Apr 2026 19:50:54 -0400
Subject: [PATCH 1/2] Create SECURITY.md

---
 docs/SECURITY.md | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)
 create mode 100644 docs/SECURITY.md

diff --git a/docs/SECURITY.md b/docs/SECURITY.md
new file mode 100644
index 0000000..0c83563
--- /dev/null
+++ b/docs/SECURITY.md
@@ -0,0 +1,17 @@
+<!--
+This is a default security policy that applies to the entire testdouble organization.
+It may be overridden by a repo-specific security policy.
+https://docs.github.com/en/communities/setting-up-your-project-for-healthy-contributions/creating-a-default-community-health-file
+-->
+
+# Security Policy 🛡️
+
+## ✅ Supported Versions
+
+Only the greatest published version (according to SemVer) will be supported.
+This version will be indicated as the "Latest Release" on GitHub Releases. :octocat:
+
+## ⚠️ Reporting a Vulnerability
+
+Use GitHub's built-in reporting mechanism for disclosure.
+Go to the Security tab -> Report a vulnerability.

From ce23c4ed320b893fcbc8554c86ccd693d6376c87 Mon Sep 17 00:00:00 2001
From: Jason Karns <jason.karns@gmail.com>
Date: Mon, 27 Apr 2026 20:00:18 -0400
Subject: [PATCH 2/2] Todo placeholders for security policy enhancement

---
 docs/SECURITY.md | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/docs/SECURITY.md b/docs/SECURITY.md
index 0c83563..aca269f 100644
--- a/docs/SECURITY.md
+++ b/docs/SECURITY.md
@@ -15,3 +15,20 @@ This version will be indicated as the "Latest Release" on GitHub Releases. :octo
 
 Use GitHub's built-in reporting mechanism for disclosure.
 Go to the Security tab -> Report a vulnerability.
+
+<!-- TODO
+
+We should add some references here to maintainer security.
+- requiring maintainers to have MFA set up
+- preferring Trusted Publishing for platforms that support it
+- + a docs link: https://github.blog/changelog/2025-07-31-npm-trusted-publishing-with-oidc-is-generally-available/
+
+- perhaps some references to securing github actions
+- https://docs.github.com/en/actions/reference/security/secure-use
+- GHA security with linters like https://github.com/zizmorcore/zizmor
+- hardening runners with: https://github.com/step-security/harden-runner
+- Enabling dependabot (both version and security alerts)
+- Enabling code security scanning: https://github.com/testdouble/.github/security
+
+
+-->