From eaef6d59577d2ed7eb386d3bfeab65309429c80b Mon Sep 17 00:00:00 2001
From: Yashovardhan Agrawal <21066442+yashovardhan@users.noreply.github.com>
Date: Thu, 15 Oct 2026 19:21:21 +0530
Subject: [PATCH] chore: pin checkout action, add SECURITY.md, Dependabot and
 .codexignore

---
 .codexignore                          |  2 ++
 .github/dependabot.yml                |  8 ++++++++
 .github/workflows/validate-plugin.yml |  2 +-
 SECURITY.md                           | 21 +++++++++++++++++++++
 4 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 .codexignore
 create mode 100644 .github/dependabot.yml
 create mode 100644 SECURITY.md

diff --git a/.codexignore b/.codexignore
new file mode 100644
index 0000000..06ec17b
--- /dev/null
+++ b/.codexignore
@@ -0,0 +1,2 @@
+.github/
+docs/
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..f9854d0
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+# Keeps pinned GitHub Actions current. See:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+version: 2
+updates:
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
diff --git a/.github/workflows/validate-plugin.yml b/.github/workflows/validate-plugin.yml
index 3b25085..a30429f 100644
--- a/.github/workflows/validate-plugin.yml
+++ b/.github/workflows/validate-plugin.yml
@@ -12,7 +12,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Validate JSON manifests
         run: |
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..d7d2947
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,21 @@
+# Security Policy
+
+## Responsible Disclosure Security Policy
+
+A responsible disclosure policy helps protect users of the project from publicly disclosed security vulnerabilities without a fix by employing a process where vulnerabilities are first triaged in a private manner, and only publicly disclosed after a reasonable time period that allows patching the vulnerability and provides an upgrade path for users.
+
+When contacting us directly via email, we will do our best efforts to respond in a reasonable time to resolve the issue. When contacting a security program their disclosure policy will provide details on time-frame, processes and paid bounties.
+
+We kindly ask you to refrain from malicious acts that put our users, the project, or any of the project's team members at risk.
+
+## Reporting a Security Issue
+
+We consider the security of our systems a top priority. But no matter how much effort we put into system security, there can still be vulnerabilities present.
+
+If you discover a security vulnerability, please use one of the following means of communications to report it to us:
+
+- Report the security issue on our [MetaMask HackerOne](https://hackerone.com/metamask) program.
+
+For further questions about our security program please visit the [MetaMask Security Program](https://metamask.io/security/) page.
+
+Your efforts to responsibly disclose your findings are sincerely appreciated and will be taken into account to acknowledge your contributions.