Enable private vulnerability reporting and streamline security policy

CHANGELOG.md

@@ -19,6 +19,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 #### Changed
 
+- **Private vulnerability reporting and a streamlined security policy** — The repository now accepts confidential reports through GitHub private vulnerability reporting. `SECURITY.md` has one complete English section and one equivalent Japanese section covering supported versions, the direct private-reporting path, report contents, response targets, coordinated disclosure, and the preserved threat model. Regression coverage protects the reporting link, bilingual policy structure, and Japanese documentation anchors. Affected: `SECURITY.md`, `README.md`, `doc/DEVELOPER_GUIDE.md`, `FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs`, and the GitHub repository security setting. Issue: #223.
+
 - **Release notes now use explicit dynamic comparison links** — The release workflow resolves the latest non-draft, non-prerelease stable GitHub Release by publication time, combines its tag with the current release tag to build the `Full Changelog` comparison URL, and appends the NuGet install/update commands in a consistent release-note template. Regression coverage keeps the release filtering, publication-time selection, dynamic URL, section order, and `nildiff` commands intact. Affected: `.github/workflows/release.yml`, `doc/DEVELOPER_GUIDE.md`, `FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs`.
 
 - **GitHub Actions now use immutable dependencies and least-privilege jobs** — Every third-party action is pinned to a reviewed full commit SHA with an adjacent release-version comment, while DocFX and `dotnet-ildasm` installations use exact versions. Mutation-summary comments, benchmark baseline updates, and CodeQL result uploads now run in separate write-capable jobs restricted to same-repository pull requests, `main` pushes, or other trusted events. Validation and CodeQL analysis remain read-only and continue to run for fork-originated pull requests. Dependabot continues to cover pinned GitHub Actions. Affected: `.github/workflows/dotnet.yml`, `.github/workflows/benchmark-regression.yml`, `.github/workflows/codeql.yml`, `.github/workflows/release.yml`, `FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs`.
@@ -1700,6 +1702,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 #### 変更
 
+- **Private vulnerability reporting とセキュリティポリシーの整理** — リポジトリは GitHub private vulnerability reporting を通じて機密報告を受け付けるようになりました。`SECURITY.md` を、サポート対象バージョン、private report への直接リンク、報告内容、対応目標、協調開示、維持した脅威モデルを一読で確認できる、完全な英語節と同等の日本語節へ整理しました。報告リンク、英日ポリシー構造、日本語文書のアンカーを回帰テストで保護します。対象: `SECURITY.md`, `README.md`, `doc/DEVELOPER_GUIDE.md`, `FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs`, GitHub リポジトリのセキュリティ設定。Issue: #223.
+
 - **リリースノートの比較リンクを明示的かつ動的に生成** — リリース workflow は公開日時を基準に、非 Draft・非 Prerelease の最新安定 GitHub Release を解決し、そのタグを今回のリリースタグと組み合わせて `Full Changelog` の比較 URL を構築し、NuGet の install/update コマンドを統一されたリリースノートテンプレートへ追加するようになりました。Release の絞り込み、公開日時による選択、動的 URL、セクション順序、`nildiff` コマンドを回帰テストで保護します。対象: `.github/workflows/release.yml`, `doc/DEVELOPER_GUIDE.md`, `FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs`。
 
 - **GitHub Actions の依存関係を不変化し、ジョブを最小権限化** — すべての third-party Action を、隣接するリリース版コメント付きのレビュー済み完全 commit SHA に固定し、DocFX と `dotnet-ildasm` のインストールも正確なバージョンへ固定しました。mutation summary の PR コメント、benchmark baseline 更新、CodeQL 結果 upload は、同一リポジトリ由来 PR、`main` push、またはその他の信頼済みイベントに限定した write 権限付き専用ジョブへ分離しました。検証と CodeQL 解析は read-only のまま fork 由来 PR でも実行します。Dependabot は固定済み GitHub Actions を引き続き更新対象にします。対象: `.github/workflows/dotnet.yml`, `.github/workflows/benchmark-regression.yml`, `.github/workflows/codeql.yml`, `.github/workflows/release.yml`, `FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs`。

FolderDiffIL4DotNet.Tests/Architecture/CiAutomationConfigurationTests.cs

@@ -99,6 +99,45 @@ public void UserFacingDocumentation_DoesNotAdvertiseHiddenSpinnerOptions()
             }
         }
 
+        /// <summary>
+        /// Verifies that the security policy directs equivalent English and Japanese guidance to the private reporting flow.
+        /// セキュリティポリシーの英日案内が同等で、非公開報告フローへ誘導することを検証します。
+        /// </summary>
+        [Fact]
+        [Trait("Category", "Unit")]
+        public void SecurityPolicy_UsesPrivateReportingAndCompleteBilingualSections()
+        {
+            const string privateReportingUrl =
+                "https://github.com/Widthdom/FolderDiffIL4DotNet/security/advisories/new";
+            var policy = File.ReadAllText(GetRepositoryFilePath("SECURITY.md"));
+            var readme = File.ReadAllText(GetRepositoryFilePath("README.md"));
+            var developerGuide = File.ReadAllText(GetRepositoryFilePath("doc", "DEVELOPER_GUIDE.md"));
+
+            Assert.True(
+                Regex.Matches(policy, "^## English$", RegexOptions.Multiline).Count == 1,
+                "SECURITY.md must contain exactly one complete English section.");
+            Assert.True(
+                Regex.Matches(policy, "^## 日本語$", RegexOptions.Multiline).Count == 1,
+                "SECURITY.md must contain exactly one complete Japanese section.");
+            Assert.Equal(2, Regex.Matches(policy, Regex.Escape(privateReportingUrl)).Count);
+            Assert.Contains("### Supported Versions", policy, StringComparison.Ordinal);
+            Assert.Contains("### サポート対象バージョン", policy, StringComparison.Ordinal);
+            Assert.Contains("within 3 business days", policy, StringComparison.Ordinal);
+            Assert.Contains("3 営業日以内", policy, StringComparison.Ordinal);
+            Assert.Contains("within 7 business days", policy, StringComparison.Ordinal);
+            Assert.Contains("7 営業日以内", policy, StringComparison.Ordinal);
+            Assert.Contains("every 14 calendar days", policy, StringComparison.Ordinal);
+            Assert.Contains("14 暦日ごと", policy, StringComparison.Ordinal);
+            Assert.Contains("### Threat Model", policy, StringComparison.Ordinal);
+            Assert.Contains("### 脅威モデル", policy, StringComparison.Ordinal);
+            Assert.DoesNotContain("open a minimal public issue", policy, StringComparison.OrdinalIgnoreCase);
+            Assert.DoesNotContain("最小限の public issue", policy, StringComparison.Ordinal);
+            Assert.Contains("SECURITY.md#日本語", readme, StringComparison.Ordinal);
+            Assert.DoesNotContain("SECURITY.md#japanese", readme, StringComparison.Ordinal);
+            Assert.Contains("../SECURITY.md#日本語", developerGuide, StringComparison.Ordinal);
+            Assert.DoesNotContain("../SECURITY.md#セキュリティ", developerGuide, StringComparison.Ordinal);
+        }
+
         /// <summary>
         /// Verifies that developers and CI share an exact SDK, formatting rules, and a blocking format gate.
         /// 開発環境と CI が同一の SDK・フォーマット規則・ブロッキング形式検証を共有することを検証します。

README.md

@@ -236,7 +236,7 @@ CLI の詳細、HTML レビュー手順、整合性検証、セマンティッ
 | ランタイム設計とコントリビューター向け注意点 | [doc/DEVELOPER_GUIDE.md](doc/DEVELOPER_GUIDE.md#guide-ja-map) |
 | テスト方針とローカルコマンド | [doc/TESTING_GUIDE.md](doc/TESTING_GUIDE.md#testing-ja-run-tests) |
 | AI エージェント向け共通指示 | [AGENT_GUIDE.md](AGENT_GUIDE.md#japanese) |
-| セキュリティモデルと報告先 | [SECURITY.md](SECURITY.md#japanese) |
+| セキュリティモデルと報告先 | [SECURITY.md](SECURITY.md#日本語) |
 | 変更履歴 | [CHANGELOG.md](CHANGELOG.md#日本語) |
 
 > **レビュー責任:** このツールはレビューのノイズを減らしますが、false negative がゼロであることは保証せず、人間のリリース判断の代替にはなりません。出荷前に、関連する commit / PR diff、ソースコード、ビルド成果物と照合して最終判断してください。