chore(security): add govulncheck CI job, SECURITY.md, and spell config

- CI runs govulncheck on every push to catch known vulnerabilities in the
  module and its dependencies.
- SECURITY.md documents the threat model (no shell interpolation, no
  credential handling, text sanitization) and how to report issues.
- Stop .gitignore's *.md rule from hiding SECURITY.md.
- cspell.json whitelists project-specific terms.

Author: ashishxcode

.github/workflows/ci.yml

@@ -17,3 +17,16 @@ jobs:
       - run: go vet ./...
       - run: go build ./...
       - run: go test -race ./...
+
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.24"
+      # Scan dependencies and our own code for known Go vulnerabilities.
+      - name: govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...

.gitignore

@@ -1,6 +1,7 @@
 # Generated reports
 *.md
 !README.md
+!SECURITY.md
 
 # Temporary files
 temp_*

SECURITY.md

@@ -0,0 +1,27 @@
+# Security
+
+## Reporting a vulnerability
+
+Please report security issues privately via
+[GitHub Security Advisories](https://github.com/ashishxcode/commit-chronicle/security/advisories/new)
+rather than opening a public issue. We aim to acknowledge reports within a few
+days.
+
+## Design notes
+
+commit-chronicle is a local, single-user CLI. It reads your own repositories and
+talks to GitHub through the `gh` CLI you have already authenticated. With that in
+mind:
+
+- **No shell interpolation.** All `git`/`gh` invocations use `exec.Command` with
+  an explicit argument vector — never a shell — so repo paths, author names, PR
+  numbers, and date strings cannot be used for command injection.
+- **No credential handling.** GitHub authentication is delegated entirely to
+  `gh`; this tool never reads, stores, or transmits tokens.
+- **Untrusted text is sanitized.** Commit messages and PR titles come from other
+  people. Before they are shown in the picker, preview, or a worklog printed to
+  the terminal, `model.CleanText` strips ANSI/terminal escape sequences and
+  control characters so a crafted message cannot hijack your terminal.
+- **Dependency scanning.** CI runs
+  [`govulncheck`](https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck) on every
+  push to catch known vulnerabilities in the module and its dependencies.

cspell.json

@@ -0,0 +1,29 @@
+{
+  "version": "0.2",
+  "language": "en",
+  "words": [
+    "ashishxcode",
+    "bubbletea",
+    "charmbracelet",
+    "fzf",
+    "GOBIN",
+    "GOPATH",
+    "gum",
+    "isatty",
+    "lipgloss",
+    "mattn",
+    "pbcopy",
+    "unioned",
+    "usr",
+    "worklog",
+    "xclip",
+    "xdg",
+    "Culture"
+  ],
+  "ignorePaths": [
+    "go.sum",
+    "go.mod",
+    "dist/",
+    "bin/"
+  ]
+}