From bd4921091ed120d5695bdaac47f747b8b72cc528 Mon Sep 17 00:00:00 2001
From: Chris Coutinho <chris@coutinho.io>
Date: Wed, 29 Apr 2026 23:45:25 +0200
Subject: [PATCH] docs(security): address second round of review feedback

- SECURITY.md: add Supported Versions table; reword SLA paragraph as
  a bullet list per reviewer suggestion
- bug_report.yml: render reproduction textarea as shell so commands and
  JSON get syntax highlighting, matching the logs field
- question.yml: add transport and install_method dropdowns mirroring
  bug_report.yml so setup questions capture the same context

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/ISSUE_TEMPLATE/bug_report.yml |  1 +
 .github/ISSUE_TEMPLATE/question.yml   | 25 +++++++++++++++++++++++++
 SECURITY.md                           | 17 ++++++++++++++++-
 3 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index 99e9c078..778041b1 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -31,6 +31,7 @@ body:
         1. Call `nc_contacts_create` with `full_name`, `email`, `phone`
         2. Inspect the contact in the Nextcloud web UI
         3. Only the name is present
+      render: shell
     validations:
       required: true
 
diff --git a/.github/ISSUE_TEMPLATE/question.yml b/.github/ISSUE_TEMPLATE/question.yml
index fad314b5..abf7ff5c 100644
--- a/.github/ISSUE_TEMPLATE/question.yml
+++ b/.github/ISSUE_TEMPLATE/question.yml
@@ -54,3 +54,28 @@ body:
         - Other / not sure
     validations:
       required: true
+
+  - type: dropdown
+    id: transport
+    attributes:
+      label: MCP transport
+      options:
+        - stdio
+        - streamable-http
+        - sse (legacy)
+        - Other / not sure
+    validations:
+      required: true
+
+  - type: dropdown
+    id: install_method
+    attributes:
+      label: How are you running the server?
+      options:
+        - uvx
+        - Docker / docker compose
+        - Helm chart on Kubernetes
+        - Local checkout (`uv run`)
+        - Other
+    validations:
+      required: true
diff --git a/SECURITY.md b/SECURITY.md
index 583a2b4c..e050a290 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,5 +1,16 @@
 # Security Policy
 
+## Supported Versions
+
+Security fixes are issued only against the latest released version. Older
+versions do not receive backported patches — please upgrade before reporting,
+and confirm the issue still reproduces on the latest release where possible.
+
+| Version  | Supported |
+|----------|-----------|
+| latest   | ✅        |
+| < latest | ❌        |
+
 ## Reporting a Vulnerability
 
 **Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
@@ -27,4 +38,8 @@ Whichever channel you use, please include as much of the following as you can to
 - The version(s) of the project affected
 - Any known mitigations or workarounds
 
-We aim to acknowledge within 5 business days and provide a fix or mitigation timeline within 30 days, and will work with you on coordinated disclosure.
+We aim to:
+
+- Acknowledge reports within 5 business days.
+- Provide a fix or mitigation timeline within 30 days.
+- Work with you on coordinated disclosure.