docs(security): address review feedback on PR #740

- SECURITY.md: add response SLA (5 business days / 30 days)
- bug_report.yml: scope the Docker log command to Docker installs
- question.yml: align deployment_mode catch-all wording with bug_report.yml

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -49,8 +49,11 @@ body:
     attributes:
       label: Logs and error output
       description: |
-        Include the full error message / stack trace from the MCP server, and any relevant entries from
-        `docker compose exec app cat /var/www/html/data/nextcloud.log | jq | tail` (Nextcloud side).
+        Include the full error message / stack trace from the MCP server.
+        If running with Docker, also include any relevant entries from
+        `docker compose exec app cat /var/www/html/data/nextcloud.log | jq | tail`
+        (Nextcloud side). For other install methods, attach the equivalent
+        Nextcloud log excerpt if available.
         Redact tokens, passwords, and personal data.
       render: shell
     validations:

.github/ISSUE_TEMPLATE/question.yml

@@ -51,6 +51,6 @@ body:
         - Login Flow v2
         - OAuth / OIDC (Nextcloud user_oidc)
         - OAuth / OIDC (external IdP, e.g. Keycloak)
-        - Not yet decided
+        - Other / not sure
     validations:
       required: true

SECURITY.md

@@ -27,4 +27,4 @@ Whichever channel you use, please include as much of the following as you can to
 - The version(s) of the project affected
 - Any known mitigations or workarounds
 
-We will acknowledge receipt and work with you on coordinated disclosure.
+We aim to acknowledge within 5 business days and provide a fix or mitigation timeline within 30 days, and will work with you on coordinated disclosure.