Add an org-wide default security policy

[jeremy]

No public Basecamp repo shows a security policy today — none carry a SECURITY.md, and this repo has no org-wide default. This adds the community-health fallback: every public repo without its own SECURITY.md inherits this one on its Security tab.

The policy splits reporting by asset class:

• Open-source libraries and ONCE apps (most of this org): GitHub private vulnerability reporting on the affected repo (already enabled across our public repos). Not bounty-eligible, though we also accept these via HackerOne for researchers who want the report on their H1 record.
• Products (Basecamp, HEY, and other in-scope assets): our public HackerOne program (https://hackerone.com/basecamp), where in-scope reports are bounty-eligible.
• Full response policy: https://37signals.com/policies/security/response/

A repo's own SECURITY.md still takes precedence, so repos that want more specific guidance (e.g. surfguard) can carry their own.

Verification after merge: check a public repo without its own policy (e.g. kamal) — its Security tab should show this inherited default.

[Copilot]

Pull request overview

Adds an organization-wide default security policy for public repositories without their own policy.

Changes:

• Documents private vulnerability-reporting channels.
• Defines expected response and disclosure practices.
• Notes repository-specific policies take precedence.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Suppressed comments (1)

SECURITY.md:14

• This reverses the reporting-channel priority stated in the PR description: the description makes HackerOne the primary channel and GitHub the per-repository alternative, while the policy directs most repositories to GitHub first and HackerOne second. Because this choice determines where reporters are sent, please either align this section with the stated HackerOne-first policy or update the PR description to document the intended GitHub-first split.

**Open-source libraries and ONCE apps** (most of what's on this GitHub org): report privately via
GitHub — the affected repository's **Security** tab → **Report a vulnerability**. These reports
aren't bounty-eligible, but we accept them via [HackerOne](https://hackerone.com/basecamp) too if
you'd like the report on your HackerOne record.