chore: add security note in all the packages

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+## Supported Packages
+
+This policy applies to all published SDK packages in this repository:
+
+- `@supashiphq/javascript-sdk`
+- `@supashiphq/react-sdk`
+- `@supashiphq/vue-sdk`
+
+## Reporting a Vulnerability
+
+Please report vulnerabilities privately:
+
+- Email: `security@supaship.com`
+- Subject: `Security report - Supaship SDK`
+- Include: affected package, version, impact, and reproduction details
+
+Do not open public issues for suspected vulnerabilities.
+
+## Disclosure Process
+
+After acknowledgement, we will:
+
+1. Validate and triage the report
+2. Prepare and test a fix
+3. Publish patched versions
+4. Share a public advisory after remediation

packages/javascript/SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Supported Versions
+
+The latest published minor version of `@supashiphq/javascript-sdk` is actively supported.
+
+## Reporting a Vulnerability
+
+If you discover a security issue, do not open a public GitHub issue.
+
+- Email: `security@supaship.com`
+- Include: impact, reproduction steps, and affected versions
+- Expected response: acknowledgement within 3 business days
+
+We will investigate, coordinate a fix, and publish a security release as needed.

packages/javascript/package.json

@@ -8,7 +8,8 @@
   "files": [
     "dist",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md"
   ],
   "scripts": {
     "clean": "rimraf dist",
@@ -48,5 +49,9 @@
   "bugs": {
     "url": "https://github.com/SupashipHQ/sdk/issues"
   },
-  "homepage": "https://supaship.com"
+  "homepage": "https://supaship.com",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
 }

packages/react/SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Supported Versions
+
+The latest published minor version of `@supashiphq/react-sdk` is actively supported.
+
+## Reporting a Vulnerability
+
+If you discover a security issue, do not open a public GitHub issue.
+
+- Email: `security@supaship.com`
+- Include: impact, reproduction steps, and affected versions
+- Expected response: acknowledgement within 3 business days
+
+We will investigate, coordinate a fix, and publish a security release as needed.

packages/react/package.json

@@ -20,7 +20,8 @@
   "files": [
     "dist",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md"
   ],
   "scripts": {
     "clean": "rimraf dist",
@@ -75,5 +76,9 @@
   "bugs": {
     "url": "https://github.com/SupashipHQ/sdk/issues"
   },
-  "homepage": "https://supaship.com"
+  "homepage": "https://supaship.com",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
 }

packages/vue/SECURITY.md

@@ -0,0 +1,15 @@
+# Security Policy
+
+## Supported Versions
+
+The latest published minor version of `@supashiphq/vue-sdk` is actively supported.
+
+## Reporting a Vulnerability
+
+If you discover a security issue, do not open a public GitHub issue.
+
+- Email: `security@supaship.com`
+- Include: impact, reproduction steps, and affected versions
+- Expected response: acknowledgement within 3 business days
+
+We will investigate, coordinate a fix, and publish a security release as needed.

packages/vue/package.json

@@ -15,7 +15,8 @@
   "files": [
     "dist",
     "README.md",
-    "LICENSE"
+    "LICENSE",
+    "SECURITY.md"
   ],
   "scripts": {
     "clean": "rimraf dist",
@@ -64,5 +65,9 @@
   "bugs": {
     "url": "https://github.com/SupashipHQ/sdk/issues"
   },
-  "homepage": "https://supaship.com"
+  "homepage": "https://supaship.com",
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  }
 }