security: a disclosure policy, and Dependabot for the four dependency surfaces

[distronode-com]

Two files Scorecard looks for and the repository does not have.

SECURITY.md points reporters at GitHub's private vulnerability reporting (the Security tab's "Report a vulnerability" button) rather than an email address, says what to include, and says what to expect: an acknowledgement within a few days, then a fix or a written reason, a public advisory with the release, and credit if wanted. It states the support policy as it is today for a pre-1.0 project: fixes land on the latest 0.x line only. If you would rather name an address or a different support window, that is a two-line edit.

.github/dependabot.yml covers the four dependency surfaces the tree actually has, all monthly: gomod at the root, npm in frontend/ (pnpm is handled by the npm ecosystem), github-actions, and docker for the root Dockerfile. Monthly rather than weekly because dependency updates here are batched by hand, and security fixes do not wait on this schedule. No groups, no ignores; it can be tuned once the first batch of PRs shows what the noise level is.

🤖 Generated with Claude Code

[pullfrog]

✅ No new issues found.

Reviewed changes in this run: the full PR (2 files, disclosure policy + Dependabot).

• SECURITY.md — Private disclosure via GitHub vulnerability reporting, report contents, response expectations, and a supported-versions table limited to the latest 0.x line (0.9.x, matching current CHANGELOG).
• .github/dependabot.yml — Weekly updates for the four in-tree surfaces: gomod at /, npm at /frontend (pnpm), github-actions at /, and docker at /.

All four Dependabot ecosystems match files that exist on the tree (go.mod/go.sum, frontend/package.json + pnpm-lock.yaml, .github/workflows/*, root Dockerfile). No application behavior changes.

ℹ️ Enable private vulnerability reporting after merge

SECURITY.md sends reporters only to the Security tab’s Report a vulnerability button and forbids public issues/PRs. That button appears only when the repo setting Private vulnerability reporting is on. If it is still off, the policy has no working intake path.

Technical details

# Enable PVR so SECURITY.md intake works

## Affected sites
- Repo Settings → Code security and analysis → Private vulnerability reporting (not in this PR)
- SECURITY.md “Reporting a vulnerability” section assumes the button exists

## Required outcome
- After merge, PVR is enabled on Calnode/calnode so external reporters can open a private thread as documented
- Optional: confirm the Security tab shows both the policy and the report button

## Open questions for the human
- None if PVR is already on; this is a one-time settings check

  ^{｜ View workflow run ｜ Using Grok ｜ 𝕏}

[shockalotti]

Happy with both files in substance — SECURITY.md matches how we actually operate (latest 0.x line only, private reporting, advisory on release) and the four dependabot surfaces are the right four. Two asks before merge:

1. Cadence: monthly, not weekly. A weekly feed across four ecosystems is more bot-PR noise than this project wants — we batch dependency updates by hand (see #43) and a standing weekly drumbeat will just train us to ignore it. Please flip all four schedule.interval entries to monthly. Security fixes still reach us same-day through the Scorecard badge + AUDIT.md scanner block, so nothing urgent waits on the bot.

2. Confirm the reporting button exists. SECURITY.md sends reporters to the Security tab's "Report a vulnerability" flow — that needs private vulnerability reporting enabled in Settings → Code security. That's a settings click on my side after merge; noting it here so it doesn't get lost. If it's already on, ignore this.

[pullfrog]

✅ No new issues found.

Reviewed changes since the prior Pullfrog review: Dependabot schedule cadence only (ad2bf61).

• Monthly interval — All four ecosystems in .github/dependabot.yml (gomod, npm, github-actions, docker) now use schedule.interval: monthly instead of weekly. SECURITY.md is unchanged.

  ^{｜ View workflow run ｜ Using Grok ｜ 𝕏}

[distronode-com]

Both done.

1. All four schedule.interval entries are now monthly (ad2bf61), and the description says so.
2. Private vulnerability reporting is already on for this repository: GET /repos/Calnode/calnode/private-vulnerability-reporting returns {"enabled": true}, so the button SECURITY.md sends reporters to exists today.