docs(security): document NVCF threat model

[FamousDirector]

TL;DR

Expand the root security policy with NVCF-specific architecture, trust
boundaries, threats, and assumptions. Add scanner triage metadata so future
repository reviews retain the confirmed exposure classifications.

Additional Details

The existing root policy covered vulnerability reporting but did not describe
the repository's architecture context, threat model, or critical security
assumptions.

This change:

• Preserves and updates the private vulnerability reporting guidance.
• Documents the control, invocation, and compute plane security boundaries.
• Adds seven code-grounded threats based on repository reconnaissance and the
  existing threat assessment.
• Records the confirmed Public repository and External / Regulated service
  classifications.
• Initializes triage lists without inventing false-positive, accepted-risk, or
  CVE decisions.
• Changes documentation and scanner metadata only. Runtime behavior is
  unchanged.

For the Reviewer

Please review:

• Whether the architecture and trust boundaries accurately represent NVCF.
• Whether the threat and assumption descriptions are public-safe and specific
  enough for repository security tooling.
• Whether the initial triage classifications and empty decision lists are
  appropriate.

For QA

Validation completed:

• git diff --check
• Parsed .security-triage.yaml and checked required schema fields.
• Checked committed text for non-ASCII content and private references.
• Checked all required security-policy sections.
• Verified every referenced repository path and invocation endpoint.
• Ran .cursor/hooks/validate-skill-fanout.py.

QA needed: No runtime QA. Documentation-only change.

Issues

NO-REF

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO)
  compliance.
• New or existing tests cover these changes. Documentation and schema
  validation apply.
• The documentation is up to date with these changes.

Summary by CodeRabbit

• Documentation
  • Replaced the security policy with an NVCF-specific security guide, including updated vulnerability reporting channels, required report checklist, and clearer operational/security guidance.
  • Added security architecture context, explicit security boundaries, threat modeling, and trust/deployment assumptions.
• Chores
  • Added a security triage configuration file documenting repository and service exposure classifications.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: ed9e64bc-31f2-4b2e-8b62-bc0ec314a71c

📥 Commits

Reviewing files that changed from the base of the PR and between 6f69763 and b32a5c6.

📒 Files selected for processing (1)

• SECURITY.md

🚧 Files skipped from review as they are similar to previous changes (1)

• SECURITY.md

---

📝 Walkthrough

Walkthrough

The PR adds security triage metadata and replaces the existing security document with an NVCF-specific policy covering reporting, architecture, boundaries, threats, assumptions, scope, and operational guidance.

Changes

Security governance

Layer / File(s)	Summary
Security triage classification .security-triage.yaml	Adds repository and service exposure classifications and empty lists for false positives, accepted risks, and suppressed CVEs.
Reporting and security architecture SECURITY.md	Defines private vulnerability reporting procedures, required report contents, NVCF architecture planes, and security boundaries.
Threat model and operational controls SECURITY.md	Documents threat categories, security assumptions, trust and deployment models, repository scope, and operational security practices.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: priyaselvaganesan

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows Conventional Commits and accurately describes the documentation-focused NVCF threat model update.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jcameron/security-md-rollout

---

_{Comment @coderabbitai help to get the list of available commands.}