Add GitHub Bug Bounty Program support documentation

.github/ISSUE_TEMPLATE/security_report.yml

@@ -0,0 +1,113 @@
+name: Security Vulnerability Report
+description: Report a security vulnerability (for non-critical issues only - critical vulnerabilities should go to HackerOne)
+title: "[Security]: "
+labels: ["security", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        ## ⚠️ Important Security Notice
+
+        **For critical security vulnerabilities**, please do NOT use this form. Instead:
+        - Submit via [GitHub's Bug Bounty on HackerOne](https://hackerone.com/github)
+        - Email [security@github.com](mailto:security@github.com)
+
+        This form is for **low-severity security concerns** that do not pose immediate risk.
+
+        See our [Security Policy](../../SECURITY.md) for more information.
+
+  - type: checkboxes
+    id: acknowledgement
+    attributes:
+      label: Pre-submission Checklist
+      description: Please confirm the following before submitting
+      options:
+        - label: This is NOT a critical vulnerability that could lead to immediate harm
+          required: true
+        - label: I have read the [Security Policy](../../SECURITY.md)
+          required: true
+        - label: I am reporting this in good faith as part of responsible disclosure
+          required: true
+
+  - type: dropdown
+    id: severity
+    attributes:
+      label: Severity Assessment
+      description: How would you classify this security concern?
+      options:
+        - Low - Minor security improvement
+        - Informational - Security best practice suggestion
+    validations:
+      required: true
+
+  - type: dropdown
+    id: category
+    attributes:
+      label: Security Category
+      description: What category does this security concern fall under?
+      options:
+        - Authentication/Authorization
+        - Data Handling
+        - Input Validation
+        - Configuration Security
+        - Documentation/Security Guidance
+        - Dependency Security
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: Describe the security concern in detail
+      placeholder: Provide a clear description of the security concern...
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to Reproduce (if applicable)
+      description: Steps to demonstrate the concern
+      placeholder: |
+        1. Run command...
+        2. Observe...
+    validations:
+      required: false
+
+  - type: textarea
+    id: impact
+    attributes:
+      label: Potential Impact
+      description: What is the potential impact if this concern is not addressed?
+      placeholder: Describe the potential impact...
+    validations:
+      required: true
+
+  - type: textarea
+    id: suggestion
+    attributes:
+      label: Suggested Fix
+      description: If you have a suggestion for how to address this concern
+      placeholder: Describe your suggested approach...
+    validations:
+      required: false
+
+  - type: input
+    id: version
+    attributes:
+      label: Copilot CLI Version
+      description: What version of Copilot CLI are you using?
+      placeholder: "e.g., 0.0.420"
+    validations:
+      required: true
+
+  - type: input
+    id: os
+    attributes:
+      label: Operating System
+      description: What operating system are you using?
+      placeholder: "e.g., macOS 15.3, Ubuntu 24.04, Windows 11"
+    validations:
+      required: true

README.md

@@ -185,6 +185,15 @@ Check configured LSP servers using the `/lsp` command in an interactive session,
 
 For more information, see the [changelog](./changelog.md).
 
+## 🔒 Security
+
+GitHub Copilot CLI is part of [GitHub's Bug Bounty Program](https://bounty.github.com/). If you discover a security vulnerability, please report it responsibly:
+
+- **Critical vulnerabilities**: Report via [HackerOne](https://hackerone.com/github) or email [security@github.com](mailto:security@github.com)
+- **See our [Security Policy](./SECURITY.md)** for full details on scope, safe harbor, and reporting guidelines
+
+We appreciate security researchers who help keep Copilot CLI and our users safe.
+
 ## 📢 Feedback and Participation
 
 We're excited to have you join us early in the Copilot CLI journey.

SECURITY.md

@@ -0,0 +1,95 @@
+# Security Policy
+
+## GitHub Bug Bounty Program
+
+GitHub Copilot CLI is part of [GitHub's Bug Bounty Program](https://bounty.github.com/). We encourage security researchers to participate in responsible security testing and disclosure.
+
+## Supported Versions
+
+Security updates are provided for the latest stable release of GitHub Copilot CLI:
+
+| Version | Supported          |
+| ------- | ------------------ |
+| Latest  | :white_check_mark: |
+| Older   | :x:                |
+
+We recommend always updating to the latest version to ensure you have the most recent security patches.
+
+## Reporting a Vulnerability
+
+**Please do not report security vulnerabilities through public GitHub issues.**
+
+If you discover a security vulnerability in GitHub Copilot CLI, please report it through GitHub's Bug Bounty Program:
+
+1. **Submit via HackerOne**: Report vulnerabilities at [https://hackerone.com/github](https://hackerone.com/github)
+2. **Email**: You can also contact [security@github.com](mailto:security@github.com) for security-related issues
+
+### What to Include
+
+When reporting a vulnerability, please include:
+
+- A clear description of the vulnerability
+- Steps to reproduce the issue
+- Affected versions
+- Potential impact assessment
+- Any proof-of-concept code (if applicable)
+
+### Response Timeline
+
+- **Initial Response**: Within 24-48 hours
+- **Status Update**: Within 5 business days
+- **Resolution Timeline**: Varies based on severity and complexity
+
+## Scope
+
+The following are in scope for security research:
+
+### In Scope
+
+- GitHub Copilot CLI application
+- Authentication and authorization mechanisms
+- Data handling and privacy
+- Network communication security
+- Local file system interactions
+- MCP (Model Context Protocol) server security
+- Plugin and extension security
+- Session management
+
+### Out of Scope
+
+- Third-party dependencies (report to the appropriate maintainers)
+- Social engineering attacks
+- Denial of service attacks
+- Issues requiring physical access to the user's device
+- Issues in GitHub's backend services (report via GitHub's main bug bounty)
+
+## Safe Harbor
+
+GitHub supports safe harbor for security researchers who:
+
+- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our services
+- Only interact with accounts you own or with explicit permission from the account holder
+- Do not exploit a security issue for purposes other than testing
+- Report any vulnerabilities promptly
+- Do not publicly disclose vulnerabilities before they are fixed
+
+We will not pursue legal action against researchers who follow these guidelines.
+
+## Security Best Practices for Users
+
+When using GitHub Copilot CLI:
+
+1. **Keep Updated**: Always use the latest version
+2. **Token Security**: Never share your authentication tokens
+3. **Review Actions**: Use plan mode to review actions before execution
+4. **MCP Servers**: Only enable trusted MCP servers
+5. **Plugins**: Install plugins only from trusted sources
+
+## Contact
+
+For non-vulnerability security questions, you can:
+
+- Open a discussion in this repository
+- Use the `/feedback` command within the CLI
+
+Thank you for helping keep GitHub Copilot CLI and our users safe!