From 313d78e6e42962b383f46e51d8f5affb3ccaf27a Mon Sep 17 00:00:00 2001
From: Dan Cockrell <173971169+dancockrell@users.noreply.github.com>
Date: Wed, 2 Sep 2026 12:49:50 +0700
Subject: [PATCH] Harden repository maintenance defaults

---
 .github/dependabot.yml   | 13 +++++++++++++
 .github/workflows/qa.yml |  6 +++---
 SECURITY.md              | 21 +++++++++++++++++++++
 3 files changed, 37 insertions(+), 3 deletions(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 SECURITY.md

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..3ca964c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /tools
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml
index ec81c3f..13889c2 100644
--- a/.github/workflows/qa.yml
+++ b/.github/workflows/qa.yml
@@ -18,10 +18,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
           cache: npm
@@ -64,7 +64,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.event.pull_request.head.ref }}
       - name: Rebuild generated files
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..96765d9
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,21 @@
+# Security policy
+
+QuickGrade processes student names, identifiers, answer sheets, and grades in
+the browser. Please do not publish a suspected vulnerability or real student
+data in a public issue.
+
+## Reporting a vulnerability
+
+Use GitHub's private vulnerability reporting form for this repository. Include
+the affected version or commit, reproduction steps using synthetic data, the
+expected impact, and any suggested mitigation.
+
+If private vulnerability reporting is unavailable, open a public issue that
+contains no exploit details or student data and ask the maintainer for a private
+contact channel.
+
+## Supported version
+
+Security fixes target the current `main` branch and the hosted build generated
+from it. Older downloaded copies should be replaced with a current build after
+a security fix is published.