Security hardening: close supply-chain and policy gaps

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "uv"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      uv:
+        patterns:
+          - "*"

.github/workflows/ci.yml

@@ -13,8 +13,8 @@ jobs:
   lint-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.11"
       - name: Install dev dependencies

.github/workflows/release.yml

@@ -13,8 +13,8 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.11"
       - name: Install build tools

.github/workflows/test.yml

@@ -16,8 +16,8 @@ jobs:
       matrix:
         python-version: ["3.10", "3.11", "3.12"]
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ matrix.python-version }}
       - name: Install package

SECURITY.md

@@ -0,0 +1,31 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.1.x   | :white_check_mark: |
+| < 0.1   | :x:                |
+
+## Reporting a Vulnerability
+
+Report vulnerabilities privately via
+[private vulnerability reporting](https://github.com/ms-kumar/torml/security/advisories/new).
+Do not open public issues for unpatched vulnerabilities.
+
+Please include:
+
+- Affected version(s) (`torml.__version__`, `uv.lock` entries if dependency-related)
+- Steps to reproduce or proof of concept
+- Impact assessment, if known
+
+Expect an initial response within 7 days. Fixes land as a patch release with
+a `RELEASES.md` entry crediting the reporter (unless anonymity is requested).
+
+## Scope Notes
+
+- `torml` has one runtime dependency (`torch`); most advisories will concern
+  the lockfile (`uv.lock`) or CI tooling, and are fixed by version bumps.
+- GitHub secret scanning and push protection are enabled; CI runs
+  CodeQL, Dependabot alerts, `pip-audit`-clean installs, and a pinned
+  (`pre-commit` + `uv.lock`) toolchain.