Added security monitoring

Author: dhondta

.github/dependabot.yml

@@ -0,0 +1,15 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      actions:
+        patterns: ["*"]
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: monthly
+    # dependencies are minimum versions (>=) ; only open security updates, not routine upgrades
+    open-pull-requests-limit: 0

.github/workflows/security.yml

@@ -0,0 +1,31 @@
+# This workflow audits the package dependencies for known vulnerabilities
+# It is separate from python-package.yml so that a new advisory never blocks a release
+
+name: security
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+  schedule:
+    - cron: "0 6 * * 1"  # weekly, catches new advisories between pushes
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  pip-audit:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v7
+    - name: Set up Python
+      uses: actions/setup-python@v7
+      with:
+        python-version: "3.13"
+    - name: Install pip-audit
+      run: python -m pip install --upgrade pip pip-audit
+    - name: Audit dependencies
+      # resolves the dependencies of pyproject.toml in an isolated environment, so only these are audited
+      run: pip-audit .

README.md

@@ -1,13 +1,13 @@
 <p align="center" id="top"><img src="https://github.com/packing-box/python-exeplot/raw/main/docs/pages/img/logo.png"></p>
 <h1 align="center">ExePlot <a href="https://twitter.com/intent/tweet?text=ExePlot%20-%20Plot%20executable%20samples%20easy.%0D%0ALibrary%20for%20plotting%20executable%20samples%20supporting%20multiple%20formats.%0D%0Ahttps%3a%2f%2fgithub%2ecom%2fpacking-box%2fpython-exeplot%0D%0A&hashtags=python,programming,executable-samples,plot"><img src="https://img.shields.io/badge/Tweet--lightgrey?logo=twitter&style=social" alt="Tweet" height="20"/></a></h1>
-<h3 align="center">Search for samples from various malware databases.</h3>
+<h3 align="center">Plot executable samples easy.</h3>
 
 [![PyPi](https://img.shields.io/pypi/v/exeplot.svg)](https://pypi.python.org/pypi/exeplot/)
 [![Read The Docs](https://readthedocs.org/projects/python-exeplot/badge/?version=latest)](https://python-exeplot.readthedocs.io/en/latest/?badge=latest)
 [![Build Status](https://github.com/packing-box/python-exeplot/actions/workflows/python-package.yml/badge.svg)](https://github.com/packing-box/python-exeplot/actions/workflows/python-package.yml)
+[![Security](https://github.com/packing-box/python-exeplot/actions/workflows/security.yml/badge.svg)](https://github.com/packing-box/python-exeplot/actions/workflows/security.yml)
 [![Coverage Status](https://raw.githubusercontent.com/packing-box/python-exeplot/coverage-badge/docs/coverage.svg)](#)
 [![Python Versions](https://img.shields.io/pypi/pyversions/exeplot.svg)](https://pypi.python.org/pypi/exeplot/)
-[![Known Vulnerabilities](https://snyk.io/test/github/packing-box/python-exeplot/badge.svg?targetFile=requirements.txt)](https://snyk.io/test/github/packing-box/python-exeplot?targetFile=requirements.txt)
 [![License](https://img.shields.io/pypi/l/exeplot.svg)](https://pypi.python.org/pypi/exeplot/)
 
 This library implements multiple plot types for illustrating executable samples. It currently supports the PE, ELF and Mach-O formats, relying on [`lief`](https://github.com/lief-project/LIEF) for abstracting them.
@@ -67,10 +67,4 @@ $ exeplot entropy calc_packed.exe --no-title --no-legend --no-label --no-entrypo
 ![Simplified entropy plot of `calc_packed.exe`](https://github.com/packing-box/python-exeplot/blob/main/docs/pages/img/calc_packed_entropy.png?raw=true)
 
 
-## :clap: Supporters
-
-[![Stargazers repo roster for @packing-box/python-exeplot](https://reporoster.com/stars/dark/packing-box/python-exeplot)](https://github.com/packing-box/python-exeplot/stargazers)
-
-[![Forkers repo roster for @packing-box/python-exeplot](https://reporoster.com/forks/dark/packing-box/python-exeplot)](https://github.com/packing-box/python-exeplot/network/members)
-
 <p align="center"><a href="#top"><img src="https://img.shields.io/badge/Back%20to%20top--lightgrey?style=social" alt="Back to top" height="20"/></a></p>

SECURITY.md

@@ -0,0 +1,17 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest release of ExePlot (`exeplot` on [PyPI](https://pypi.org/project/exeplot/)) receives security fixes.
+
+## Reporting a Vulnerability
+
+Please do **not** report security vulnerabilities through public GitHub issues.
+
+Instead, report them privately through [GitHub's private vulnerability reporting](https://github.com/packing-box/python-exeplot/security/advisories/new) (the repository's *Security* tab, then *Report a vulnerability*). Please include:
+
+- the ExePlot version (`exeplot --help` prints it);
+- the steps to reproduce the issue, and a sample (or its hash) if relevant;
+- the impact you expect.
+
+You will get an answer as soon as possible. Once the issue is confirmed, a fix is released and the advisory is published.