From a55cc1e94003952c47267be22580524481bd3bb7 Mon Sep 17 00:00:00 2001
From: Ti-03 <qutibah.an3@gmail.com>
Date: Wed, 22 Jul 2026 00:16:45 +0300
Subject: [PATCH] security: least-privilege CI token + SECURITY.md (Scorecard
 fixes)

OpenSSF Scorecard scored the repo 3.0/10. The two zero-score checks
fixable from inside the repo:
- Token-Permissions: ci.yml had no permissions block, so jobs got the
  default token with write access to contents. Build-and-test needs
  read-only.
- Security-Policy: no SECURITY.md; reporters had no private path and
  would have to open a public issue for a vulnerability.
---
 .github/workflows/ci.yml |  5 +++++
 SECURITY.md              | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 SECURITY.md

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e550a95..9c36be1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,11 @@ on:
     branches: [main]
   pull_request:
 
+# Least privilege: build-and-test only reads the repo. Without this block
+# the job gets the default token, which can write contents.
+permissions:
+  contents: read
+
 jobs:
   build-test:
     name: Build & Test (${{ matrix.os }})
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..9bc0e1c
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,33 @@
+# Security Policy
+
+## Supported versions
+
+| Version | Supported |
+| ------- | --------- |
+| 1.1.x   | Yes       |
+| < 1.1   | No        |
+
+## Reporting a vulnerability
+
+Please do not open a public issue for security problems.
+
+Report vulnerabilities privately through
+[GitHub Security Advisories](https://github.com/Ti-03/MacDirStat/security/advisories/new)
+("Report a vulnerability" on the repo's Security tab). That keeps the report
+confidential while a fix is prepared.
+
+What to include:
+
+- What the issue is and where (file, function, or behavior).
+- Steps to reproduce, or a proof of concept.
+- What an attacker gains (impact).
+
+What to expect:
+
+- An acknowledgment within 7 days.
+- A fix or a status update within 30 days for confirmed issues.
+- Credit in the release notes if you want it.
+
+MacDirStat is a local, on-device app: it never sends data off the machine, so
+most issues in scope are local ones (unsafe file operations, privilege
+mistakes, malicious folder contents crashing or confusing the scanner).