fix(builder): remove non-deliverable email from SECURITY.md

[iap]

Greptile identified that SECURITY.md contained a non-deliverable email address (iap@users.noreply.github.com) for vulnerability reporting. DNS lookup returned NXDOMAIN for the recipient domain. Replaced with GitHub Security Advisories as the primary contact method, keeping the GPG key for encrypted reports via that channel.

Greptile Summary

This change provides a GitHub Security Advisories reporting path for vulnerability disclosures and improves provider setup so its model catalog is refreshed from the plugin manifest. The existing-provider setup flow was exercised with a custom endpoint and preserved that endpoint while updating models.

Confidence Score: 5/5

No blocking failure remains.

The focused provider setup check preserved an existing custom endpoint and exact numeric-looking model identifier while refreshing the provider catalog.

T-Rex Logs

What T-Rex did

• Ran a temporary Hermes configuration containing an existing aws-builder provider with a custom remote endpoint, then invoked scripts/setup.sh with port 9123.
• The generated YAML preserved base_url as the custom endpoint, set model to auto, and kept the model key as the string '4.0'.
• The port 9123 appeared only in the adapter probe and did not overwrite the existing provider endpoint, showing that the existing-provider refresh path preserves user configuration.
• Validation confirms the observed YAML facts (base_url, model auto, and quoted '4.0') and notes the adapter-probe port behavior.

_{Ran code and verified through T-Rex}

_{Reviews (2): Last reviewed commit: "fix(builder): remove non-deliverable ema..." | Re-trigger Greptile}

[greptile-apps]

Encrypted-report instructions lack an obtainable public key

The instructions direct reporters to encrypt with “the GPG key below,” but only provide its fingerprint. A fresh GnuPG installation cannot encrypt to that fingerprint without first obtaining the public key, and the policy provides neither an armored key nor a retrieval URL, keyserver command, or identity for discovering one. Publish the public key or provide a stable, authenticated retrieval and fingerprint-verification procedure so sensitive reports can follow the documented workflow.

Artifacts

Validation source and failed isolated GnuPG encryption run

• The captured command output includes the authored validator and its execution against SECURITY.md lines 12–13, showing that no retrieval mechanism is documented and GnuPG cannot encrypt with the fingerprint alone.

Reproducible GPG documentation validation script

• The Bash source creates an isolated empty GnuPG keyring, reads only the specified documentation lines, and attempts encryption to the documented fingerprint.

Failed encryption using only the documented fingerprint

• The executed isolated-keyring run shows GnuPG reporting `No public key` and exiting 2 when encryption is attempted with the documented fingerprint alone.

Documentation retrieval-mechanism check

• The executed documentation check prints the two target lines and confirms that public-key material and retrieval references are absent.

_{Ran code and verified through T-Rex}