Harden QuickGrade repository maintenance

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /tools
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/qa.yml

@@ -18,10 +18,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.event.pull_request.head.ref || github.ref_name }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
           cache: npm
@@ -64,7 +64,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.event.pull_request.head.ref }}
       - name: Rebuild generated files

SECURITY.md

@@ -0,0 +1,21 @@
+# Security policy
+
+QuickGrade processes student names, identifiers, answer sheets, and grades in
+the browser. Please do not publish a suspected vulnerability or real student
+data in a public issue.
+
+## Reporting a vulnerability
+
+Use GitHub's private vulnerability reporting form for this repository. Include
+the affected version or commit, reproduction steps using synthetic data, the
+expected impact, and any suggested mitigation.
+
+If private vulnerability reporting is unavailable, open a public issue that
+contains no exploit details or student data and ask the maintainer for a private
+contact channel.
+
+## Supported version
+
+Security fixes target the current `main` branch and the hosted build generated
+from it. Older downloaded copies should be replaced with a current build after
+a security fix is published.