docs(security): add scope, out-of-scope, and OAuth beta warning (#917)

* docs(security): add scope, out-of-scope, and OAuth beta warning

* fix(security): clarify out-of-scope deployment item per GB review

* fix(security): restore good-faith requirement per GB review

* fix(security): remove redundant auth bypass from OAuth mode list

* fix(security): add coordinated disclosure timeline per GB review

* docs(security): replace speculative tool name with capability description

Removes `ha_manage_custom_tool` (PR #854, not yet merged, name not finalized)
and replaces it with a capability-based description to avoid naming-convention
violations on a forward reference.

* fix: correct env var name, remove unmerged sandbox ref, drop stale CVE count

---------

Co-authored-by: Patch76 <patch76@users.noreply.github.com>

Author: Patch76

SECURITY.md

@@ -2,18 +2,58 @@
 
 ## Supported Versions
 
-| Version | Supported          |
-| ------- | ------------------ |
-| latest  | :white_check_mark: |
+| Version | Supported |
+| ------- | --------- |
+| latest  | ✅        |
 
+## Scope
 
-## Reporting a Vulnerability
+**In scope** — please report these:
+
+- Authentication bypass in standard (LLAT) or OAuth mode
+- OAuth mode: XSS, SSRF, token leakage, open redirect
+- Prompt injection paths that circumvent tool-level safeguards
+  (e.g., HA entity data triggering unintended tool calls)
+- Privilege escalation within the MCP tool surface
+- Unintended information disclosure via API responses
+- Dependency vulnerabilities with a credible exploit path
+
+**Out of scope** — these will not be actioned:
+
+- Vulnerabilities in Home Assistant itself →
+  report to [home-assistant/core](https://github.com/home-assistant/core/security)
+- Vulnerabilities in Nabu Casa or other remote access infrastructure
+- Attacks requiring physical access to the HA host
+- "The LLM performed a destructive action using valid, authorized tools" —
+  this is a configuration or usage issue, not a security vulnerability.
+  Tool visibility controls (`ENABLED_TOOL_MODULES`, group toggles) exist for this purpose.
+- Vulnerabilities that are only exploitable due to a misconfigured deployment
+  (e.g., standard-mode instance exposed to the internet without TLS)
+
+## OAuth Mode — Beta Warning
 
-Use the page at https://github.com/homeassistant-ai/ha-mcp/security/
+The OAuth consent-flow mode (`ha-mcp-oauth` entrypoint) is **experimental**
+and carries a larger attack surface than the standard LLAT setup.
+
+- Not recommended for production without TLS and network access restrictions
+- Requires explicit opt-in (`ha-mcp-oauth`); the default entrypoint is unaffected
+- CVEs were published and fixed in v7.x (XSS: GHSA-pf93-j98v-25pv;
+  SSRF: GHSA-fmfg-9g7c-3vq7). Upgrade to the latest release before deploying.
+
+If you choose to run OAuth mode, restrict the consent endpoint to trusted networks
+and place it behind a TLS-terminating reverse proxy.
+
+## Reporting a Vulnerability
 
-Reports will be assessed within 48 hours. Fixes may take an additional 24–48 hours.
+Use the private reporting page at:
+**https://github.com/homeassistant-ai/ha-mcp/security/advisories/new**
 
-Reports **must be made in good faith** and accurately reflect the real severity and impact of the vulnerability.  
-Overstated, exaggerated, misleading, or speculative reports will be deprioritized or rejected.
+Reports are assessed within 48 hours; fixes may take an additional 24–48 hours. We aim for coordinated disclosure and will work with you to agree on a disclosure timeline, typically within 90 days of the initial report.
+Severity is assessed using CVSS base scores where applicable.
 
-Low-quality or AI-generated submissions that do not demonstrate a real, reproducible security issue may take longer to process or be closed without action.
+**Requirements for a valid report:**
+- Reports must be made in good faith
+- Demonstrate a real, reproducible issue with steps to reproduce
+- Accurately reflect severity and impact — overstated reports are deprioritized
+- Low-quality or AI-generated submissions without a working proof of concept
+  will be closed without action