chore: add security CI (CodeQL, gitleaks, dependency-review, Dependabot)

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Default code owners. Enforced via branch protection (required review).
+* @abrichr

.github/dependabot.yml

@@ -0,0 +1,17 @@
+# SOC 2: automated dependency updates (OA-C-23).
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"

.github/workflows/codeql.yml

@@ -0,0 +1,37 @@
+name: CodeQL
+
+# SOC 2: SAST (OA-C-24). Static analysis on push/PR to main + weekly.
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 5 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["python"]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        with:
+          languages: ${{ matrix.language }}
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/dependency-review.yml

@@ -0,0 +1,21 @@
+name: Dependency Review
+
+# SOC 2: dependency-review (OA-C-24). Flags vulnerable/denied deps on PRs.
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    name: dependency-review
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Dependency Review
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
+        with:
+          fail-on-severity: high

.github/workflows/secret-scan.yml

@@ -0,0 +1,32 @@
+name: Secret Scan
+
+# SOC 2: secret scanning (OA-C-24). Uses the free, MIT-licensed gitleaks CLI.
+# NOTE: the gitleaks *Action* now requires a paid GITLEAKS_LICENSE for
+# organization-owned repos (even public ones); the gitleaks CLI does not, so we
+# invoke it directly and pin the version. Scans full git history on PRs + main.
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    name: gitleaks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+      - name: Install gitleaks
+        env:
+          GITLEAKS_VERSION: 8.30.1
+        run: |
+          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
+            | tar -xz -C /usr/local/bin gitleaks
+          gitleaks version
+      - name: Scan git history for secrets
+        run: gitleaks git . --redact --no-banner

SECURITY.md

@@ -0,0 +1,35 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+We take the security of OpenAdapt seriously. If you believe you have found a
+security vulnerability in this repository, please report it **privately** — do
+**not** open a public issue, discussion, or pull request that describes it.
+
+**Preferred:** use GitHub's private vulnerability reporting. Go to the
+repository's **Security** tab and click **Report a vulnerability**. This opens a
+private advisory visible only to the maintainers.
+
+**Alternative:** email **hello@openadapt.ai** with the details.
+
+Please include, where possible:
+
+- A description of the vulnerability and its potential impact
+- Steps to reproduce (a proof-of-concept if you have one)
+- Affected version(s), commit, endpoint, or configuration
+- Any suggested remediation
+
+## Our commitment
+
+- We will **acknowledge** your report within **5 business days**.
+- We will provide an estimated timeline for a fix and keep you updated on
+  progress.
+- We will credit reporters who wish to be acknowledged once a fix has shipped.
+- Please give us a reasonable opportunity to remediate before any public
+  disclosure.
+
+## Supported versions
+
+Security fixes are applied to the latest released version on the `main` branch.
+
+Thank you for helping keep OpenAdapt and its users safe.