docs: acknowledge Y4tacker security report

[killagu]

Summary

Add a Security Acknowledgements section to SECURITY.md and credit Y4tacker for responsibly reporting the command injection vulnerability in @eggjs/security's escapeShellArg helper.

References

• 4.x fix: fix: escape shell arg single quotes security#106
• 3.x fix: fix: escape shell arg single quotes security#107

Validation

Documentation-only change; verified the acknowledgement and fix links in the rendered Markdown structure.

Summary by CodeRabbit

• Documentation
  • Added a Security Acknowledgements section recognizing a researcher for responsibly reporting a command injection issue.
  • Included references to the relevant fixes across supported versions.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: ae69d44e-1033-4d4a-9672-60c06cf98105

📥 Commits

Reviewing files that changed from the base of the PR and between 196f11d and 24e53d6.

📒 Files selected for processing (1)

• SECURITY.md

---

📝 Walkthrough

Walkthrough

SECURITY.md now includes a Security Acknowledgements section crediting Y4tacker for responsibly disclosing a command injection issue related to escapeShellArg, with links to fixes in the 4.x and 3.x branches.

Changes

Security acknowledgement

Layer / File(s)	Summary
Add security acknowledgement SECURITY.md	Adds acknowledgement text and a table listing the researcher, vulnerability, and related fixes.

Estimated code review effort: 1 (Trivial) | ~2 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch agent/add-y4tacker-security-acknowledgement

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gemini-code-assist]

Code Review

This pull request updates the SECURITY.md file to add a 'Security Acknowledgements' section, thanking a security researcher for reporting a command injection vulnerability. There are no review comments, and I have no additional feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[cloudflare-workers-and-pages]

Deploying egg with    Cloudflare Pages

Latest commit:	24e53d6
Status:	✅  Deploy successful!
Preview URL:	https://d61ab5af.egg-cci.pages.dev
Branch Preview URL:	https://agent-add-y4tacker-security.egg-cci.pages.dev

View logs

[cloudflare-workers-and-pages]

Deploying egg-v3 with    Cloudflare Pages

Latest commit:	24e53d6
Status:	✅  Deploy successful!
Preview URL:	https://5e78754e.egg-v3.pages.dev
Branch Preview URL:	https://agent-add-y4tacker-security.egg-v3.pages.dev

View logs

[Copilot]

Pull request overview

This PR updates the repository’s security policy documentation by adding an acknowledgement section to credit a security researcher for responsible disclosure related to @eggjs/security.

Changes:

• Add a new Security Acknowledgements section to SECURITY.md.
• Credit Y4tacker for reporting a command injection issue in escapeShellArg, with links to the 4.x and 3.x fixes.