`SECURITY.md` existed on the pre-swap `main` (ac3c1a12) and still exists on
`v1/main`, but the v2 tree never had one — so #1817 silently removed the
security policy from the default branch.
That is the wrong file to be missing right now: it is where private
vulnerability reporting is advertised, and it disappeared in the same window as
2.0.0 shipping and external pull requests being turned off (#1820). Losing the
PR path and the security-report path together would leave an outside reporter
with no documented route at all.
Restored from `v1/main` with the additions #1820 asks for:
- A supported-versions table covering all four package names — v2 supported, the
v1 line security-fixes-only under the `v1-latest` dist-tag, anything below
1.0.0 unsupported. The three sub-packages are named explicitly since they
exist only on v1 and are deprecated.
- A note that the repository does not accept outside pull requests, but that
this explicitly does NOT apply to security reports, which must go through the
advisory process rather than any public channel. Without that, the new
issues-only policy reads as "no way to reach us".
- "Whether it affects v2, v1, or both" added to the report checklist, now that
two lines are live.
Verified private vulnerability reporting is enabled on the repo, so the advisory
link is a working route rather than an aspiration.
Claude-Session: https://claude.ai/code/session_01Txmv2qqv3yeKgRzoqXytzD
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
