From afe6d2eccd4dd1b22e91b695c57046d818112264 Mon Sep 17 00:00:00 2001
From: Don Petry <36422719+don-petry@users.noreply.github.com>
Date: Sat, 24 Oct 2026 19:43:49 -0500
Subject: [PATCH 1/2] chore(security): remove local SECURITY.md to inherit
 org-wide policy

---
 SECURITY.md | 30 ------------------------------
 1 file changed, 30 deletions(-)
 delete mode 100644 SECURITY.md

diff --git a/SECURITY.md b/SECURITY.md
deleted file mode 100644
index 3684dd56..00000000
--- a/SECURITY.md
+++ /dev/null
@@ -1,30 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-| Version | Supported          |
-| ------- | ------------------ |
-| 1.x     | :white_check_mark: |
-
-## Reporting a Vulnerability
-
-If you discover a security vulnerability in this project, please report it responsibly.
-
-**Please do NOT open a public GitHub issue for security vulnerabilities.**
-
-Instead, please use [GitHub's private vulnerability reporting](https://github.com/combsmith/broodly/security/advisories/new).
-
-### What to include
-
-- A description of the vulnerability
-- Steps to reproduce the issue
-- Any potential impact
-- Suggested fix (if any)
-
-### Response timeline
-
-- **Acknowledgement**: Within 48 hours of receipt
-- **Initial assessment**: Within 1 week
-- **Resolution target**: Within 30 days for critical issues
-
-We appreciate your help in keeping this project and its users safe.

From ee3e4003744d4dcce4fffa0615acd1a33a1ae4bb Mon Sep 17 00:00:00 2001
From: Rachel Petry <287457313+rachel-petry@users.noreply.github.com>
Date: Sat, 24 Oct 2026 20:42:15 -0500
Subject: [PATCH 2/2] chore(deps): suppress unpatched transitive zod v3
 advisory in pnpm audit

---
 pnpm-workspace.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 69a96181..102dacf6 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -40,9 +40,13 @@ overrides:
 # through @expo/html-elements > react-native > metro > micromatch > braces.
 # Suppressed until braces 3.0.4+ is released.
 # Re-evaluate when: https://github.com/micromatch/braces/releases shows >= 3.0.4
+# zod < 4.6.6 has a DoS advisory on oversized constrained collections.
+# @expo/cli depends on zod v3 (^3.23.8) and there is no v3 patch (fix is >= 4.6.6).
+# Suppressed until @expo/cli migrates to zod v4 or a v3 backport is published.
 audit:
   ignore:
     - GHSA-w3rx-r6r6-pgpr
     - GHSA-5p2g-fcmc-qvqq
     - GHSA-86w9-cpqp-85rv
     - GHSA-vfj7-8cjw-p6xm
+    - GHSA-mrhx-c7xc-m3w5