docs(security): point reporters at the now-enabled private advisory form

[lidge-jun]

Summary

SECURITY.md described a private reporting path that did not exist, so a
reporter following it had no way to disclose privately.

The file told reporters to prefer "this repository's GitHub private
vulnerability reporting or GitHub Security Advisory flow when that option is
available in the repository UI", and then stated that the project publishes no
private security email. At the time, GET /repos/lidge-jun/opencodex/private-vulnerability-reporting
returned {"enabled": false} and the repository had zero published advisories,
so none of the named private channels resolved to anything. The only remaining
instruction was to open a public issue asking for a safe coordination path —
which is exactly what the policy opens by telling people not to do.

Changes

Private vulnerability reporting has been enabled on the repository
({"enabled": true}), and the advisory form now returns HTTP 200.

• SECURITY.md — replace the conditional wording with the direct advisory URL
  and the Security-tab location. The minimal-public-issue text stays, demoted
  from default to fallback for reporters who cannot reach the form.
• .github/ISSUE_TEMPLATE/config.yml — add the advisory form as the first
  contact link, above the security-policy link, so the chooser routes reporters
  to the private path before they can open an issue.
• README.md — name the private path where the docs section already points at
  SECURITY.md.

Verification

• https://github.com/lidge-jun/opencodex/security/advisories/new → HTTP 200
• gh api repos/lidge-jun/opencodex/private-vulnerability-reporting → {"enabled":true}
• .github/ISSUE_TEMPLATE/config.yml parses; contact links resolve to
  ["Report a security vulnerability (private)", "Security policy", "Contributing guide"]
• The pre-push hook ran bun run test to completion before this branch was
  pushed.

Docs-only; no runtime code touched.

Follow-up

Dependabot security updates are currently disabled on the repository and
should be enabled separately.

[coderabbitai]

📝 Walkthrough

Walkthrough

The PR adds GitHub private vulnerability reporting guidance to the issue template configuration, README, and SECURITY.md, including report requirements and fallback instructions when the advisory form is unreachable.

Changes

Security reporting guidance

Layer / File(s)	Summary
Private vulnerability reporting guidance .github/ISSUE_TEMPLATE/config.yml, README.md, SECURITY.md	Adds a private security reporting contact link and README guidance, and updates SECURITY.md with the advisory form, required report details, coordination-channel clarification, and minimal public fallback instructions.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: wibias, ingwannu

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: updating security docs to point reporters to the enabled private advisory form.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/260729-security-md-reporting-path

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Around line 512-514: Update the README security-reporting guidance to include
the same fallback as SECURITY.md: if GitHub private vulnerability reporting is
unreachable, allow opening a minimal public coordination issue without
disclosing vulnerability details. Keep the private reporting recommendation as
the primary path.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 3fed8ce6-b410-467e-8094-a413d100161e

📥 Commits

Reviewing files that changed from the base of the PR and between c7e48fb and d0763bf.

📒 Files selected for processing (3)

• .github/ISSUE_TEMPLATE/config.yml
• README.md
• SECURITY.md

[coderabbitai]

🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Document the unreachable-form fallback here too.

This wording unconditionally says “not a public issue,” but SECURITY.md Lines 31-32 correctly permits a minimal public coordination issue when the advisory form is unreachable. Without that exception, README-only readers have no safe next step if the private form cannot be accessed.

Proposed clarification

 Report undisclosed vulnerabilities privately through
 [GitHub private vulnerability reporting](https://github.com/lidge-jun/opencodex/security/advisories/new),
-not a public issue.
+not a public issue. If the form is unreachable, open a minimal public issue requesting a safe
+coordination path without including exploit details, secrets, or live targets.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	Report undisclosed vulnerabilities privately through
	[GitHub private vulnerability reporting](https://github.com/lidge-jun/opencodex/security/advisories/new),
	not a public issue.
	Report undisclosed vulnerabilities privately through
	[GitHub private vulnerability reporting](https://github.com/lidge-jun/opencodex/security/advisories/new),
	not a public issue. If the form is unreachable, open a minimal public issue requesting a safe
	coordination path without including exploit details, secrets, or live targets.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@README.md` around lines 512 - 514, Update the README security-reporting
guidance to include the same fallback as SECURITY.md: if GitHub private
vulnerability reporting is unreachable, allow opening a minimal public
coordination issue without disclosing vulnerability details. Keep the private
reporting recommendation as the primary path.