docs(security): add scope, out-of-scope, and OAuth beta warning

SECURITY.md

@@ -2,18 +2,57 @@
 
 ## Supported Versions
 
-| Version | Supported          |
-| ------- | ------------------ |
-| latest  | :white_check_mark: |
+| Version | Supported |
+| ------- | --------- |
+| latest  | ✅        |
 
+## Scope
 
-## Reporting a Vulnerability
+**In scope** — please report these:
+
+- Authentication bypass in standard (LLAT) or OAuth mode
+- OAuth mode: XSS, SSRF, token leakage, auth bypass, open redirect
+- Prompt injection paths that circumvent tool-level safeguards
+  (e.g., HA entity data triggering unintended tool calls)
+- Privilege escalation within the MCP tool surface
+- Sandbox escape in `ha_manage_custom_tool` (if enabled)
+- Unintended information disclosure via API responses
+- Dependency vulnerabilities with a credible exploit path
+
+**Out of scope** — these will not be actioned:
+
+- Vulnerabilities in Home Assistant itself →
+  report to [home-assistant/core](https://github.com/home-assistant/core/security)
+- Vulnerabilities in Nabu Casa or other remote access infrastructure
+- Attacks requiring physical access to the HA host
+- "The LLM performed a destructive action using valid, authorized tools" —
+  this is a configuration or usage issue, not a security vulnerability.
+  Tool visibility controls (`DISABLED_TOOLS`, group toggles) exist for this purpose.
+- Standard-mode deployments with no web-facing endpoint and a correctly scoped token
+
+## OAuth Mode — Beta Warning
 
-Use the page at https://github.com/homeassistant-ai/ha-mcp/security/
+The OAuth consent-flow mode (`ha-mcp-oauth` entrypoint) is **experimental**
+and carries a larger attack surface than the standard LLAT setup.
+
+- Not recommended for production without TLS and network access restrictions
+- Requires explicit opt-in (`ha-mcp-oauth`); the default entrypoint is unaffected
+- Two CVEs were published and fixed in v7.x (XSS: GHSA-pf93-j98v-25pv;
+  SSRF: GHSA-fmfg-9g7c-3vq7). Upgrade to the latest release before deploying.
+
+If you choose to run OAuth mode, restrict the consent endpoint to trusted networks
+and place it behind a TLS-terminating reverse proxy.
+
+## Reporting a Vulnerability
 
-Reports will be assessed within 48 hours. Fixes may take an additional 24–48 hours.
+Use the private reporting page at:
+**https://github.com/homeassistant-ai/ha-mcp/security/advisories/new**
 
-Reports **must be made in good faith** and accurately reflect the real severity and impact of the vulnerability.  
-Overstated, exaggerated, misleading, or speculative reports will be deprioritized or rejected.
+Reports are assessed within 48 hours; fixes may take an additional 24–48 hours.
+Severity is assessed using CVSS base scores where applicable.
 
-Low-quality or AI-generated submissions that do not demonstrate a real, reproducible security issue may take longer to process or be closed without action.
+**Requirements for a valid report:**
+- Demonstrate a real, reproducible issue with steps to reproduce
+- Accurately reflect severity and impact — overstated reports are deprioritized
+- Low-quality or AI-generated submissions without a working proof of concept
+  will be closed without action