docs(security): clarify local trust and reportable boundaries

[mldangelo-oai]

Summary

• Clarify that existing operating-system-account access, private scan state, approved local tools, and trusted release infrastructure are not independent security boundaries.
• Keep repository-controlled paths and symlinks, unauthorized targets or credentials, documented cost limits, truthful scan coverage, and release integrity explicitly in scope.
• Explain which prerequisite access, estimate uncertainty, terminal behavior, and hypothetical supplier compromise are insufficient by themselves.

Review focus

Confirm that the same-account process exclusion does not suppress repository-controlled subprocess, path, or symlink attacks that alter results, resume receipts, or supported coverage gates.

Verification

• Inventoried applicable policies with the bundled resolve_security_md.py --list resolver.
• Resolved the root policy and verified its content matches SECURITY.md exactly after the resolver's source header.
• Verified 12 local-trust, target, credential, symlink, cost-limit, coverage, and release-integrity invariants.
• prettier --check SECURITY.md
• git diff --check
• Documentation-only change; runtime tests were not run.

[mldangelo-oai]

@codex review the exact current head 0a349f5. Verify that the same-account process exclusion does not suppress repository-controlled hooks, filters, executables, paths, or symlinks that alter scan results, resume receipts, authorized targets or credentials, documented cost limits, truthful coverage gates, or release integrity.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 0a349f5a34

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Security review completed. No security issues were found in this pull request.

Reviewed commit: 0a349f5a34

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.