[Security 19] security posture: SECURITY.md, CodeQL, secret scan, Scorecard

[amal66]

This picks up the security-posture pieces that #227 (npm audit gate, security ESLint, dependabot) doesn't cover. No overlap: #227 gates dependencies and code patterns on each PR; this PR adds a disclosure policy and three scanners.

What's in it

• SECURITY.md — tells a researcher how to reach you privately (GitHub's built-in reporting, no email needed), what to expect (acknowledgment within 7 days — it says plainly you're a solo maintainer), and what's in scope. Since Mike is an LLM legal product, prompt-injection reports are explicitly invited.
• CodeQL (codeql.yml) — GitHub's own static analyzer, on every PR, push to main, and weekly. Both backend/ and frontend/ are interpreted TypeScript, so it needs no build step. Findings appear under the Security tab, not as PR noise.
• Secret scan (gitleaks.yml + .gitleaks.toml) — scans the entire git history for committed credentials on every PR and push. It deliberately does not use the official gitleaks-action, which requires a paid license key for organization repos — instead it downloads the pinned 8.30.1 binary and verifies its sha256 before running. I ran it over all 551 commits locally: the only hits were fake keys in tests and docs examples (verified by hand, each one allowlisted with a comment in .gitleaks.toml), so the check starts green and any new secret fails CI.
• OpenSSF Scorecard (scorecard.yml) — a weekly automated report card on the repo's own security hygiene (branch protection, workflow permissions, etc.), published to the public OpenSSF database.

Maintainer action required (repo Settings, ~2 minutes)

1. Enable private vulnerability reporting: Settings → Code security → "Private vulnerability reporting" → Enable. Without this, the "Report a vulnerability" button SECURITY.md points to doesn't exist.
2. Enable secret scanning + push protection: Settings → Code security → enable both "Secret scanning" and "Push protection". This is GitHub's server-side layer; the gitleaks workflow complements it, but push protection is the one that stops a secret before it lands in history.
3. Optional, after the first Scorecard run on main: add the badge to README —
   [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Open-Legal-Products/mike/badge)](https://scorecard.dev/viewer/?uri=github.com/Open-Legal-Products/mike)

Notes

• CodeQL and Scorecard results go to the Security tab (code scanning); only the gitleaks job blocks PRs directly.
• codeql-action is pinned to the v3 major; Scorecard to v2.4.3.
• Merge order vs [Security 11] Server-side hardening pack  #227 doesn't matter — the two touch disjoint files.

🤖 Generated with Claude Code

[CLAassistant]

All committers have signed the CLA.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.