From 6158714acf5ca86dda1f360d3c288f28ffa6e6ba Mon Sep 17 00:00:00 2001
From: Ivan Pereira <183991+ivanrvpereira@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:42:56 +0100
Subject: [PATCH] docs: add security policy

---
 SECURITY.md | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..c7a4312
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,18 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest published version of `pi-perplexity` receives security fixes.
+
+## Reporting a Vulnerability
+
+Please **do not** open a public issue for security vulnerabilities.
+
+Instead, report privately via [GitHub private vulnerability reporting](https://github.com/ivanrvpereira/pi-perplexity/security/advisories/new).
+
+You can expect an initial response within a week. Please include steps to reproduce and the impact you believe the issue has.
+
+## Scope Notes
+
+- This extension talks to an undocumented Perplexity endpoint and stores auth tokens at `~/.config/pi-perplexity/auth.json` (mode `0600`). Issues around token handling or storage are in scope.
+- The package is published to npm via GitHub Actions OIDC trusted publishing; no long-lived publish tokens exist.