docs(builder): clean SECURITY.md commit (remove real email from commit body)

[iap]

The squash merge commit fb4a9b5 on main contains the real email (iap@disroot.org) in the commit message body. This PR replaces it with a clean commit that uses no-reply email in file content and removes the real email from the commit message body. This is a rebase from PR #91 + the clean SECURITY.md commit.

Greptile Summary

This change adds a security policy covering vulnerability-report contents, response expectations, scope, and reporting channels. The listed email channel cannot receive reports because the GitHub noreply address has no mail-delivery route. Replace it with a monitored mailbox or remove the email option and direct reporters to a monitored GitHub Security Advisory channel.

Merge safety: not safe to merge until the reporting contact is made reachable.

Confidence Score: 3/5

The policy should not be merged as written because one advertised security-reporting channel is unreachable.

The exact documented recipient was checked through DNS/MX lookup and an SMTP connection attempt. Both demonstrated that mail cannot be routed to the address, and GitHub documentation identifies the address format as a noreply identity address rather than an inbound mailbox.

Files Needing Attention: SECURITY.md line 9 needs a monitored reporting address or removal of the email reporting option.

Security Review

The security policy advertises an email reporting channel that cannot receive inbound messages. This can prevent researchers from privately reporting vulnerabilities and disrupt coordinated disclosure.

T-Rex Logs

What T-Rex did

• T-Rex produced proof for the posted P1 finding.
• T-Rex produced proof for the second posted P1 finding.
• T-Rex ran the requested verification, but its local artifact references were not uploaded.

_{Ran code and verified through T-Rex}

Comments Outside Diff (1)

1. General comment

   Security reporting channel uses an unroutable GitHub noreply address

   • Bug
     • SECURITY.md:9 directs reporters to iap@users.noreply.github.com. The concrete DNS and SMTP routing checks for that exact address found no MX record, no fallback A/AAAA address, and therefore no reachable SMTP destination. A security report sent there cannot be delivered to a maintainer.
   • Cause
     • A GitHub noreply commit-identity address was documented as an inbound security mailbox.
   • Fix
     • Replace the address with a maintainer-controlled, monitored mailbox, or remove the email channel and direct reporters exclusively to GitHub Security Advisories if that channel is enabled and monitored.

   _{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "docs(builder): add proper SECURITY.md wi..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[greptile-apps]

Security reporting email cannot receive messages

iap@users.noreply.github.com is a GitHub noreply identity address, not a maintainer-controlled inbox. DNS and SMTP routing checks for that exact recipient found no MX record or fallback address, so researchers who use the documented email option cannot deliver a report or receive the stated acknowledgment. Replace it with a monitored maintainer mailbox, or remove the email option and direct reporters exclusively to monitored GitHub Security Advisories.

_{Ran code and verified through T-Rex}

[iap]

Closed: changes applied via PR #95 merge. No real email remains in file content or PR bodies.