docs(security): reconcile organization reporting and guarantee boundaries

[BunsDev]

Objective

Make the organization-level security policy a safe cross-repository routing contract instead of a stale promise surface.

What changed

• establishes repository-specific SECURITY.md precedence;
• routes reports to private GitHub Security Advisories in the affected repository;
• provides OpenCoven/coven private advisories as a temporary organization-wide intake when ownership is unclear;
• removes public Discord and personal-DM disclosure guidance;
• removes unmeasured 48-hour acknowledgment and 14-day remediation promises;
• requires synthetic evidence and prohibits real prompts, memories, credentials, tokens, session IDs, private paths, and user data;
• expands cross-repository scope across identity, authority, runtime, memory, orchestration, GitHub delivery, artifacts, update channels, transport, synchronization, and integration risk;
• separates enforced properties, residual risks, and protocol/product direction;
• prohibits unsupported certification, absolute-security, universal-continuity, full-conformance, hosted-availability, SLA, and response-time claims;
• requires downstream public security pages to link to applicable policy rather than copying mutable promises.

Evidence and motivation

OpenCoven/coven@main now explicitly publishes no acknowledgment/remediation deadline and identifies its repository advisory as the monitored intake. The organization policy still named a personal Discord DM and guaranteed 48-hour/14-day targets. This PR removes that contradiction before the landing /security route is rebuilt.

Non-goals

• defining repository-specific enforced properties;
• claiming certification or audit status;
• creating a new security service or personal mailbox;
• changing private advisory configuration.

Refs the OpenCoven landing vNext security-route migration and organization readiness work.

[Copilot]

Pull request overview

Updates the organization-wide SECURITY.md to act as a cross-repository routing and claim-boundary contract, removing stale or overly strong promises and tightening guidance for private vulnerability intake.

Changes:

• Establishes policy precedence (repo-specific SECURITY.md overrides org policy) and clarifies public summary pages don’t create new guarantees.
• Routes vulnerability reporting to GitHub Security Advisories per affected repository, with OpenCoven/coven as a fallback intake when ownership is unclear.
• Replaces fixed response-time promises with explicit non-guarantee language and adds clearer boundaries around “enforced properties” vs goals vs public claims.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.