donpetry-bot · Oct 25, 2026 · Oct 25, 2026
@@ -131,4 +131,4 @@ For commercial inquiries, email [support@combsmith.com](mailto:support@combsmith
 
 ## Contributing
 
-See the org-wide [Contributing Guide](https://github.com/combsmith/.github/blob/main/CONTRIBUTING.md) and [SECURITY.md](SECURITY.md).
+See the org-wide [Contributing Guide](https://github.com/combsmith/.github/blob/main/CONTRIBUTING.md) and [Security Policy](https://github.com/combsmith/.github/blob/main/SECURITY.md).
@@ -22,7 +22,8 @@ set -euo pipefail
 # It also emits the root/baseline files (AC #3): AGENTS.md (consumer pointer),
 # CLAUDE.md (1-line pointer), .github/CODEOWNERS, .github/dependabot.yml (from the
 # chosen standards/dependabot/<stack>), sonar-project.properties, .gitignore,
-# LICENSE, SECURITY.md, README.md, BOOTSTRAP.md. No issue/PR templates and no
+# LICENSE, README.md, BOOTSTRAP.md (SECURITY.md is inherited org-wide from
+# combsmith/.github). No issue/PR templates and no
 # labeler config are introduced (AC #5). README.md's commercial-support section is
 # read from standards/commercial-support-standard.md at the resolved ref (#2233).
 #
@@ -170,7 +171,6 @@ readonly -a BASELINE_MANIFEST=(
   "sonar-project.properties|gen"
   ".gitignore|gen"
   "LICENSE|gen"
-  "SECURITY.md|gen"
   "README.md|gen"
   "BOOTSTRAP.md|gen"
 )
@@ -471,15 +471,6 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-EOF
-      ;;
-    SECURITY.md) cat <<'EOF'
-# Security Policy
-
-To report a vulnerability, please follow the org-wide policy in
-[`combsmith/.github`](https://github.com/combsmith/.github/blob/main/SECURITY.md).
-
-Do not open public issues for security reports.
 EOF
       ;;
     README.md)
@@ -510,7 +501,7 @@ verification checks, and the short list of org-admin steps a human finishes.
 | CI (`build-and-test`, `Secret scan (gitleaks)`, `coverage`) and SonarCloud | `ci.yml`, `sonarcloud.yml` | Green out of the box; replace the shell steps with your stack's |
 | Copilot cloud-agent setup | `copilot-setup-steps.yml` | Uncomment your stack block |
 | Dependabot | `.github/dependabot.yml` | `frontend` stack by default; swap for yours |
-| Baseline files | `CODEOWNERS`, `AGENTS.md`, `CLAUDE.md`, `SECURITY.md`, `LICENSE`, `.gitignore` (secrets baseline), `.gitleaks.toml`, `sonar-project.properties`, `copilot-instructions.md` | Docs need the project's name; the Sonar key is derived from the repo by `sonarcloud.yml` |
+| Baseline files | `CODEOWNERS`, `AGENTS.md`, `CLAUDE.md`, `LICENSE`, `.gitignore` (secrets baseline), `.gitleaks.toml`, `sonar-project.properties`, `copilot-instructions.md` | Docs need the project's name; the Sonar key is derived from the repo by `sonarcloud.yml` |
 | Repo settings, rulesets, labels, GHAS | not files | Applied by `bootstrap-new-repo.sh` in `combsmith/.github` (org admin) |
 | Initiatives board (`add-to-project`) | stub only | Red until an org admin both grants the repo the `INITIATIVES_APP_*` org secrets (selected visibility) and adds it to the `combsmith-planner` app installation |
 
@@ -596,7 +587,7 @@ by PR, and the compliance audit flags any hand edit as drift):
 |---|---|
 | `.github/workflows/add-to-project.yml`, `agent-shield.yml`, `auto-rebase.yml`, `dependabot-automerge.yml`, `dependabot-rebase.yml`, `dependency-audit.yml`, `dev-lead.yml`, `initiative-driver.yml`, `persona-mention.yml`, `pr-auto-review.yml`, `pr-review-mention.yml` | Thin caller stubs. Behaviour lives in the org reusables; the `uses:` pin is moved centrally. `agent-shield.yml` is additionally a security boundary agents must never modify. |
 | `.github/CODEOWNERS` | `* @combsmith/org-leads` must stay the first owner on every line. Add path lines only *after* it. |
-| `CLAUDE.md`, `SECURITY.md`, `LICENSE` | Org pointers and license. |
+| `CLAUDE.md`, `LICENSE` | Org pointer and license (`SECURITY.md` is inherited org-wide from `combsmith/.github`). |
 | `.gitignore` — the block between `>>> BEGIN combsmith secrets baseline` and `<<< END` | Hash-checked by the compliance audit. Edit only **below** the END marker. |
 | `.gitleaks.toml` | Keep the file; you may only **append** allowlist paths under `[allowlist]`. |
 | `.github/workflows/sonarcloud.yml` | Keep as shipped; the `SonarCloud` job name is a required check, and it derives `sonar.projectKey` / `sonar.organization` from the repo (`<owner>_<name>` / `<owner>`), so no per-repo key is needed. |

@@ -68,7 +68,7 @@ by PR, and the compliance audit flags any hand edit as drift):
 |---|---|
 | `.github/workflows/add-to-project.yml`, `agent-shield.yml`, `auto-rebase.yml`, `dependabot-automerge.yml`, `dependabot-rebase.yml`, `dependency-audit.yml`, `dev-lead.yml`, `initiative-driver.yml`, `persona-mention.yml`, `pr-auto-review.yml`, `pr-review-mention.yml` | Thin caller stubs. Behaviour lives in the org reusables; the `uses:` pin is moved centrally. `agent-shield.yml` is additionally a security boundary agents must never modify. |
 | `.github/CODEOWNERS` | `* @combsmith/org-leads` must stay the first owner on every line. Add path lines only *after* it. |
-| `CLAUDE.md`, `SECURITY.md`, `LICENSE` | Org pointers and license. |
+| `CLAUDE.md`, `LICENSE` | Org pointer and license (`SECURITY.md` is inherited org-wide from `combsmith/.github`). |
 | `.gitignore` — the block between `>>> BEGIN combsmith secrets baseline` and `<<< END` | Hash-checked by the compliance audit. Edit only **below** the END marker. |
 | `.gitleaks.toml` | Keep the file; you may only **append** allowlist paths under `[allowlist]`. |
 | `.github/workflows/sonarcloud.yml` | Keep as shipped; the `SonarCloud` job name is a required check, and it derives `sonar.projectKey` / `sonar.organization` from the repo (`<owner>_<name>` / `<owner>`), so no per-repo key is needed. |

@@ -20,7 +20,7 @@ verification checks, and the short list of org-admin steps a human finishes.
 | CI (`build-and-test`, `Secret scan (gitleaks)`, `coverage`) and SonarCloud | `ci.yml`, `sonarcloud.yml` | Green out of the box; replace the shell steps with your stack's |
 | Copilot cloud-agent setup | `copilot-setup-steps.yml` | Uncomment your stack block |
 | Dependabot | `.github/dependabot.yml` | `frontend` stack by default; swap for yours |
-| Baseline files | `CODEOWNERS`, `AGENTS.md`, `CLAUDE.md`, `SECURITY.md`, `LICENSE`, `.gitignore` (secrets baseline), `.gitleaks.toml`, `sonar-project.properties`, `copilot-instructions.md` | Docs need the project's name; the Sonar key is derived from the repo by `sonarcloud.yml` |
+| Baseline files | `CODEOWNERS`, `AGENTS.md`, `CLAUDE.md`, `LICENSE`, `.gitignore` (secrets baseline), `.gitleaks.toml`, `sonar-project.properties`, `copilot-instructions.md` | Docs need the project's name; the Sonar key is derived from the repo by `sonarcloud.yml` |
 | Repo settings, rulesets, labels, GHAS | not files | Applied by `bootstrap-new-repo.sh` in `combsmith/.github` (org admin) |
 | Initiatives board (`add-to-project`) | stub only | Red until an org admin both grants the repo the `INITIATIVES_APP_*` org secrets (selected visibility) and adds it to the `combsmith-planner` app installation |
 

@@ -219,14 +219,15 @@ EOF
 }
 
 # ── manifest: baseline set (AC #3) ────────────────────────────────────────────
-@test "list-baseline: includes every required root/baseline file" {
+@test "list-baseline: includes every required root/baseline file and omits SECURITY.md (inherited org-wide)" {
   run bash "$SEED" --list-baseline
   [ "$status" -eq 0 ]
   for f in AGENTS.md CLAUDE.md .github/CODEOWNERS .github/dependabot.yml \
            .gitleaks.toml sonar-project.properties .gitignore LICENSE \
-           SECURITY.md README.md BOOTSTRAP.md; do
+           README.md BOOTSTRAP.md; do
     [[ "$output" == *"$f"* ]] || { echo "missing baseline: $f" >&2; false; }
   done
+  [[ "$output" != *"SECURITY.md"* ]]
 }
 
 # ── repin: caller stubs → published major-scoped channel tags (AC #1, #2) ──────
@@ -909,8 +910,8 @@ GHEOF
 SEED_FIXTURES="$SCRIPT_DIR/tests/fixtures/seed-repo-template"
 # Git blob SHAs of those two repo-template files (guards the fixtures themselves
 # against an editor/hook adding a trailing newline).
-REPO_TEMPLATE_README_BLOB=a6b17a8c32f6181248e55a17f9254bb0480f0f3d
-REPO_TEMPLATE_BOOTSTRAP_BLOB=18f42406609dcb019362fc012c2ffc70b5c8de43
+REPO_TEMPLATE_README_BLOB=de0e2dfbed19a3391a0b2fcddf3a22ebad6e809e
+REPO_TEMPLATE_BOOTSTRAP_BLOB=758298548cb22893267585aea9ad4803beacf641
 REPO_TEMPLATE_AGENTS_BLOB=1c5e6cb3b131037b7a103ebf33c243fac9facd0c
 
 _fixture_commercial_standard() {
Original file line number	Diff line number	Diff line change
Expand Up		@@ -131,4 +131,4 @@ For commercial inquiries, email [support@combsmith.com](mailto:support@combsmith

		## Contributing

		See the org-wide [Contributing Guide](https://github.com/combsmith/.github/blob/main/CONTRIBUTING.md) and [SECURITY.md](SECURITY.md).
		See the org-wide [Contributing Guide](https://github.com/combsmith/.github/blob/main/CONTRIBUTING.md) and [Security Policy](https://github.com/combsmith/.github/blob/main/SECURITY.md).