docs(dependencies): clarify socket.yml is registry-side scan, not CI gate (#12664)

* docs(dependencies): clarify socket.yml is registry-side scan, not CI gate

* docs(dependencies): add changelog fragment for socket.yml scope note

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

---------

Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

SECURITY.md

@@ -218,6 +218,8 @@ These rules are enforced by tooling and reviewers:
 
 ## Supply-chain scanner findings (Socket.dev / Snyk / similar)
 
+> **Scope note:** `socket.yml` at the repository root only shapes `projectIgnorePaths` for Socket.dev's registry-side post-publish scan of the published npm artifact — it is not an enforced CI/PR merge gate. No workflow in `.github/workflows`, no `package.json` script, and no `Makefile` target invokes Socket.dev.
+
 The published `omniroute` npm artifact bundles the Next.js `output: "standalone"`
 build, which means every route handler — including documented privileged
 features (MITM, Zed import, Cloud Sync, embedded service supervisor) — ends

changelog.d/maintenance/12664-socket-yml-scope-note.md

@@ -0,0 +1,3 @@
+- **docs(dependencies):** clarify that `socket.yml` only shapes Socket.dev's registry-side
+  post-publish scan of the published npm artifact — it is not an enforced CI/PR merge gate
+  ([#12664](https://github.com/diegosouzapw/OmniRoute/pull/12664) — thanks @toor11).

docs/security/SOCKET_DEV_FINDINGS.md

@@ -5,6 +5,8 @@ description: "Maintainer attestation for the AI-detected potential-malware findi
 
 # Socket.dev / supply-chain finding attestation
 
+> **Scope note:** `socket.yml` configures Socket.dev's registry-side post-publish scan of the npm artifact (ignore-paths for non-shipped content such as `tests/`, `docs/`, and build reports). It does not wire a CI/PR merge gate — no workflow in `.github/workflows`, no `package.json` script, and no `Makefile` target invokes Socket.dev.
+
 This document is the maintainer-authored attestation for the six
 `AI-detected potential malware` findings raised against `omniroute@3.8.5` and
 the mitigations applied in `omniroute@3.8.6`. It exists so:

socket.yml

@@ -1,6 +1,12 @@
 # Socket.dev / Socket GitHub app configuration.
 # Documentation: https://docs.socket.dev/docs/socket-yml
 #
+# NOTE: This file does NOT enforce a CI/PR gate. No workflow in
+# .github/workflows, no package.json script, and no Makefile target invokes
+# Socket.dev. It only shapes `projectIgnorePaths` for Socket's registry-side
+# post-publish scan of the published npm artifact (see
+# docs/security/SOCKET_DEV_FINDINGS.md).
+#
 # OmniRoute bundles privileged opt-in features (MITM proxy, Zed credential
 # import, embedded service supervisor, Cloud Sync) inside the Next.js
 # standalone build output. The v3.8.6 release applies in-tree mitigations for