memcache - chore: defense - scaffold security docs

[jaredwray]

Summary

Scaffold the public security policy and the defense-in-depth checklist so this repo can be hardened one item at a time against the latest catalog.

Status update

DEFENSE_IN_DEPTH.md: § 1 Security docs → (PR #105 pending)

Reconciled already-true items (no matching PR): packageManager pin (pnpm@11.5.2), no Dependabot config, workflow permissions: contents: read, no pull_request_target, accurate repository.url, Aikido GitHub app on builds, Socket GitHub app on PRs. Existing pnpm cooldown is 2 days (2880), not the catalog's 7-day baseline — that stays unchecked for a later PR.

Changes

• Replace SECURITY.md with private-disclosure reporting plus a "How this repository is secured" summary (no control bullets until those sections land).
• Add DEFENSE_IN_DEPTH.md from the current catalog (Profile: npm library · public).

Verification

• SECURITY.md and DEFENSE_IN_DEPTH.md present and internally linked
• Followed the Contributing and Code of Conduct guidelines
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage — docs-only; no code or test changes

Reference

defense-in-depth-nodejs § 1

  

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (589c733) to head (7bba6c5).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #105   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            8         8           
  Lines         1399      1399           
  Branches       303       308    +5     
=========================================
  Hits          1399      1399           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7bba6c59d8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Mark the newly added security documents as present

When this commit lands, both checklist requirements are already satisfied by this same diff, but they remain unchecked and permanently labeled “PR #105 pending.” Because this file is presented as the repository's security-progress tracker, the merged document will incorrectly report that its own security policy and checklist are missing; mark these entries complete rather than recording transient PR state.

Useful? React with 👍 / 👎.