Thank you for catching this and filling the gap. As I shared, we had it for the Vector SDK thanks to @Luke-Larsen, but appreciate you spotting this and adding the solution, @selkij! Will have @JSKitty review to make sure everything is up to standard before pushing.

To tighten up around the clock, I've gone and setup all Best Practice repository security precautions and services that I could; and I'll also setup some of my own (automated PR audits) shortly, the final piece of the puzzle is the Disclosure Policy, which you've gracefully provided us, really do appreciate this nudge and writing! 🙏

This PR is absolutely solid, I believe there's only two small additions I'd like before merging, open to discussion, of course;

• Email [email protected] is reachable in an encrypted format from a Proton email, which may be seen faster by me, it can be an additional contact to our vectorapp email.
• There is (understandably) often an expectation of compensation for disclosures, we do not have the funding to do this (we ourselves work on Vector voluntarily, as of now), that may change in the future, but as it stands, I think having a clear mention that we cannot currently compensate for findings or bounties, would prevent misunderstandings early.

That aside, beautiful first PR contribution. 🙏 💚

Does this look good ? You can tell me directly what to change by using the reviewing GitHub feature.

It can be merged then!