docs(security): write down the threat model and correct two claims

[sunny-wego]

• edge-cli sentence (SECURITY.md:11-15). "Publishes on every merge" was false. edge-cli has an on.push.paths filter (.github/workflows/edge-cli.yml:31-42: src/**, scripts/**, plugin/**, skills/**, package.json, bun.lock, tsconfig.json, biome.jsonc, the two composite actions, the workflow itself). The new wording is narrowed to that filter. The conclusion still holds, because a vulnerability fix lands in src/**.
• Notification sentence (SECURITY.md:15-17). "Notifies all ten repository admins" named a head count that will drift, and promised a delivery that per-user notification settings actually decide. It now says a report reaches the maintainers through GitHub.
• Out-of-scope bullet (SECURITY.md:71-73). "Already control the user's machine" could be read as cancelling the in-scope "token storage on disk" (SECURITY.md:59). It is now "already run code as the user, or already hold their Wego credentials", with exposure to other local users or processes kept explicitly in scope.
• New ## Threat model (SECURITY.md:76-108). Each boundary claim was checked:
  • The repo is public: gh api repos/wego/cli → visibility: public.
  • No pull_request_target: git grep -nE "pull_request_target" -- .github/ returns nothing.
  • release-badge.yml:41 watches only Release (cli) (tag push, release-cli.yml:36-37) and Promote (cli) / Rollback (cli) (workflow_dispatch only). The two fork-triggerable workflows, ci-cli and fulcio-pin-check, are not in that list.
  • Code-owner review: gh api repos/wego/cli/branches/main/protection → require_code_owner_reviews: true, with release paths listed in .github/CODEOWNERS.
  • Tag creation: gh api repos/wego/cli/rulesets/22870024 (v-tags, refs/tags/v*, creation/update/deletion). Its bypass actors are the wego-cli-release app (gh api apps/wego-cli-release → id 4905398) and the cli-release-signers team (id 19618049).
  • Signing detail is not repeated. The section points to "How releases are protected" instead.
• CODEOWNERS (.github/CODEOWNERS:113-118). /SECURITY.md is now owned. The self-update and credential entries (.github/CODEOWNERS:56-63) cite it as their reason for being owned, so its scope should not be narrowable without the same review.

The threat model is published. Specific weaknesses we have chosen to deprioritize are deliberately left out of this public file.

Checks: bun run lint passes and bun test scripts/ gives 407 pass, 0 fail.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ThXwuYTEizf7foXH3biz5P

Summary by CodeRabbit

• Documentation
  • Clarified when edge-cli publishes updates and how to report security findings.
  • Expanded security guidance with covered threat scenarios, protected assets, release-pipeline boundaries, and criteria for assessing insider-related cases.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: wego/cli/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Essentials

Run ID: b6acadd5-49f8-44a2-a164-8fe6bad9127d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: wego/cli/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Essentials

Run ID: c151331b-3fef-4a76-9725-97353e41533a

📥 Commits

Reviewing files that changed from the base of the PR and between 943c536 and b43f047.

📒 Files selected for processing (2)

• .github/CODEOWNERS
• SECURITY.md

Included review availability: 3 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The pull request updates security reporting guidance and threat-model scope in SECURITY.md. It also assigns the document to the owners of existing security-sensitive paths.

Changes

Security reporting policy

Layer / File(s)	Summary
Reporting guidance and threat model SECURITY.md	The guidance ties CLI publication to relevant source or build changes and updates the reporting criteria. The threat model defines in-scope parties, protected assets, release boundaries, and insider-related cases.
Security document ownership .github/CODEOWNERS	Adds /SECURITY.md to the existing security-sensitive ownership rules.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to b43f0

The security guidance and ownership update have no identified merge-blocking issue. Confirm the described repository protections during normal review.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows the required type(scope): subject format. docs(security) identifies the documentation area, and the lowercase imperative subject describes the threat model and claim corrections.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}