docs: add org community health defaults

[AlbinoGeek]

Summary

Adds organization-default community health files so repos without their own still show a complete Community health panel. Adapted from the live set on Rethunk-AI/.github (PR #2).

• SECURITY.md — private disclosure via GitHub advisories or oss@rethunk.tech; scope framed for CLIs, hooks, and CI Actions
• SUPPORT.md — issues / we.rethunk.tech / OSS email; archived repos point at the org profile Archived section (no Discord row)
• CONTRIBUTING.md — Conventional Commits + PR expectations (defers to repo-specific docs)
• CODE_OF_CONDUCT.md — Contributor Covenant 2.1; enforcement via oss@rethunk.tech
• README.md — one Documentation-table row pointing at the four files (profile/README.md unchanged)

No invented contacts or projects. Repo-level files still win when present.

Test plan

• Files present at repo root (org defaults)
• Spot-check a public repo without its own SECURITY.md (after merge) for inherited Community health links
• Confirm no oss@rethunk.ai / Discord / "Prior art" leftovers in this PR

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
github	Ready	Preview	Sep 14, 2026 4:04pm UTC

[Copilot]

🔵 Needs a closer look

Organization-default links and branch references need correction before approval.

Pull request overview

Adds organization-default GitHub community health files for repositories without local versions.

Changes:

• Added security, support, contribution, and conduct policies.
• Linked the community health files from README.md.
• Added repository and archived-project guidance.

File summaries

File	Description
SUPPORT.md	Support channels and issue guidance
SECURITY.md	Default vulnerability reporting policy
README.md	Links to community health files
CONTRIBUTING.md	Contribution and PR expectations
CODE_OF_CONDUCT.md	Contributor Covenant policy

Review details

Suppressed comments (6)

CONTRIBUTING.md:9

• When this organization-default file is inherited, GitHub resolves this relative link against Rethunk-Tech/.github, not the consuming repository. A repository with its own CODE_OF_CONDUCT.md is therefore still sent to the organization default, despite the override guidance above. Use explicit repository-local guidance with an absolute fallback to the organization policy.

- Be respectful — see [`CODE_OF_CONDUCT.md`](CODE_OF_CONDUCT.md).

CONTRIBUTING.md:34

• When this organization-default file is inherited, this relative link resolves to Rethunk-Tech/.github/SECURITY.md, not the affected repository's policy. That can route a vulnerability report using the generic policy even when the repository defines different reporting instructions. Please state the repository-specific fallback explicitly and link the organization default with an absolute URL.

Report vulnerabilities privately — see [`SECURITY.md`](SECURITY.md).

CONTRIBUTING.md:27

• This organization-wide fallback is consumed by repositories whose default branch may not be main; the parenthetical makes the generic contribution instruction inaccurate for those repositories. Refer only to the repository's default branch and leave any branch naming to repo-specific docs.

1. Branch from the repository default branch (`main` unless noted).

SECURITY.md:16

• The <repo> placeholder is never substituted in an organization-default file, so copying this URL sends reporters to a literal, nonexistent repository path. Since this policy promises a GitHub advisory route, direct readers to the affected repository's Security tab instead of publishing a non-functional URL.

   `https://github.com/Rethunk-Tech/<repo>/security/advisories/new`

SECURITY.md:9

• Because this is the organization-wide fallback, a consuming repository may use a default branch other than main; this text would then incorrectly tell reporters that only main is supported and that security fixes land there. Refer to the affected repository's default branch without hardcoding main.

Unless a repo says otherwise, only the default branch (`main`) is supported.
Security fixes land there; there is typically no long-lived release branch.

SUPPORT.md:11

• When this organization-default file is inherited, this relative link resolves to the organization repository's SECURITY.md, not a repository-specific SECURITY.md. A repo with its own disclosure channel can therefore be directed to the wrong instructions. Replace the relative link with explicit repository-local guidance and an absolute organization-default fallback.

| Security vulnerability | See [`SECURITY.md`](SECURITY.md) — do **not** file a public issue |

• Files reviewed: 5/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.