[gaborbernat]

python-discovery had no threat model, so whether a report is a vulnerability or a bug was decided case by case at triage. 🛡️ This adds a threat model and rewrites the security policy around it, so a reporter and a maintainer reach the same verdict from the same page.

The threat model lists what python-discovery trusts, the untrusted inputs with the guarantee python-discovery makes for each, the STRIDE threats and their controls, the release chain, accepted risks, and a table of example reports with their verdicts. The boundary follows comparable tools in other ecosystems: Go os/exec path lookup (Go), nvm (Shell), uv (Rust). The shared rule is the one the Node.js threat model states: a report that first needs a trusted element compromised is a bug, not a vulnerability.

.github/SECURITY.md keeps the existing reporting channels and adds response targets, the supported-versions rule and the in-scope and out-of-scope lists. Every repository in this rollout except pipx, virtualenv and build gets the same layout in its own draft PR.