Address token and security policy OpenSSF findings

.github/workflows/release.yaml

@@ -4,8 +4,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  id-token: write
-  contents: write
+  contents: read
 
 env:
   VERSION_FILE: pkg/version/version.go
@@ -14,6 +13,9 @@ jobs:
   tag:
     if: ${{ github.repository }} == 'chainguard-dev/malcontent'
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: write
     steps:
     - uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7
       with:

.github/workflows/style.yaml

@@ -3,6 +3,9 @@
 
 name: Code Style
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     branches:

.github/workflows/version.yaml

@@ -9,9 +9,7 @@ on:
         default: 'minor'
 
 permissions:
-  contents: write
-  id-token: write
-  pull-requests: write
+  contents: read
 
 env:
   VERSION_FILE: pkg/version/version.go
@@ -20,6 +18,10 @@ jobs:
   version:
     if: ${{ github.repository }} == 'chainguard-dev/malcontent'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+      pull-requests: write
     steps:
     - uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7
       with:

SECURITY.md

@@ -0,0 +1,19 @@
+# `malcontent` Security Policy
+
+## Reporting Security Issues
+
+Security issues or vulnerabilities can be reported in one of two ways:
+- By emailing `security@chainguard.dev`
+- By reporting a finding privately via https://github.com/chainguard-dev/malcontent/security/advisories/new
+
+## Addressing Security Issues
+
+Security issues or vulnerabilities can also be addressed directly via a PR -- contributions are always welcome.
+
+More on contributing can be found in [DEVELOPMENT.md](DEVELOPMENT.md).
+
+## Addressing Rule Coverage Gaps
+
+While `malcontent` aims to err on the "paranoid" side of scanning, certain behaviors, including malicious behaviors, may not be covered by the existing YARA Rules.
+
+If this is the case, please open an issue: https://github.com/chainguard-dev/malcontent/issues or feel free to contribute changes or additions.