docs(contributing): document PR base branch and fix security page descriptions

[youssefea]

What changed? Why?

• Adds an "Opening a Pull Request" section to the contribution guidelines: PRs target master, new pages must be .mdx because the Docs Style / Conformance check and orphan detection only cover .mdx files, and snippets / .mintignore files are exempt. The README submission steps point to it.
• Fixes the description of "How to Avoid Getting Your App Flagged as Malicious", which described the bug bounty program, and makes "Reporting Vulnerabilities" the page whose description mentions the HackerOne and Cantina bug bounty programs. llms.txt and llms-full.txt updated to match.

Notes to reviewers

None.

How has it been tested?

node scripts/lint-mdx.js docs/specifications/security, node scripts/validate-docs-structure.js and npm test pass; links checked.

Screenshots

N/A (description metadata and contributor docs only; no visible page layout changes).

Generated with Toshi

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
base	🟢 Ready	View Preview	Oct 9, 2026, 1:45 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[linear]

DEVREL-822