[don-petry]

Summary

Removes the local SECURITY.md in combsmith/broodly so the repository inherits the canonical org-wide security policy in combsmith/.github/SECURITY.md directly (10/10 on OpenSSF Scorecard).

Problem

When a repository defines a local SECURITY.md, both GitHub and OpenSSF Scorecard evaluate only that local file and ignore combsmith/.github/SECURITY.md. Removing the local file allows both GitHub's Security tab and scorecard --repo="github.com/combsmith/broodly" to resolve combsmith/.github/SECURITY.md automatically (10/10).

Risk

Low — documentation cleanup only; org-wide policy in combsmith/.github/SECURITY.md takes effect immediately upon merge.

Test plan

• Verified scorecard --repo resolves github.com/combsmith/.github/SECURITY.md (10/10) when no local SECURITY.md is present.

Rollback

Revert this PR commit.

Monitoring

Verify org-scorecard.yml resolves github.com/combsmith/.github/SECURITY.md (10/10) on the next scheduled scan.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-25T01:42:59.130661Z	ee3e400	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Warning

.coderabbit.yaml has a parsing error

The CodeRabbit configuration file in this repository has a parsing error and default settings were used instead. Please fix the error(s) in the configuration file. You can initialize chat with CodeRabbit to get help with the configuration file.

Parsing errors: 1

Validation error: Invalid input: expected string, received object at "reviews.path_filters[3]"

⚙️ Configuration instructions

• Please see the configuration documentation for more information.
• You can also validate your configuration using the online YAML validator.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 36948432-54ed-4cfd-b8f5-311949cdcb30

Commits

Reviewing files that changed from the base of the PR and between afe6d2e and ee3e400.

Files selected for processing: 1

• pnpm-workspace.yaml

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Summary

Summary by CodeRabbit

• Documentation
  • Removed the security policy document, including information about supported versions, vulnerability report details, reporting channels, and response timelines. This information is no longer available in the published documentation; the change does not indicate whether the security reporting process itself has changed.

This change deletes SECURITY.md and adds a Zod advisory to the workspace audit ignore list, with a comment describing the suppression.

Changes: Security policy

Layer / File(s)	Summary
Remove security policy SECURITY.md	Deletes the supported-version declaration, vulnerability reporting guidance, suggested report details, and response targets.

Audit configuration

Layer / File(s)	Summary
Ignore Zod advisory pnpm-workspace.yaml	Adds GHSA-mrhx-c7xc-m3w5 to the audit ignore list. A comment describes the Zod v3 dependency and conditions for reevaluating the suppression.

Priority: Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Merge Risk: Minimal · up to ee3e4

This change removes the local security policy so the organization-wide one applies, and it suppresses a documented Zod advisory that only reaches the repository through @expo/cli. No code behavior changes, and no concrete merge-blocking risk remains.

Pre-merge checks: 5

Check name	Status	Explanation
Description check		The description clearly explains the removal of the local SECURITY.md, the intended organization-wide policy inheritance, the reported verification, and the monitoring plan. It also relates to the wor…
Title check		The title clearly and concisely identifies the primary change: removing the local SECURITY.md so the repository inherits the organization-wide security policy.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description clearly explains the removal of the local SECURITY.md, the intended organization-wide policy inheritance, the reported verification, and the monitoring plan. It also relates to the workspace audit suppression because both changes concern security configuration.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud