maintenance - add SECURITY.md for PHP API client && tag_admin example

Author: derpixler

SECURITY.asc

@@ -0,0 +1,14 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mDMEZVsi2RYJKwYBBAHaRw8BAQdAIm/0t+RboVPq5syrc0n9hP3UPH7xok7mNCqM
+5R39oZi0JVphbW1hZCBTZWN1cml0eSA8c2VjdXJpdHlAemFtbWFkLmNvbT6ImQQT
+FgoAQRYhBARIHz68FJQ7lF5Ox7snHWG50ZiEBQJlWyLZAhsDBQkSzAMABQsJCAcC
+AiICBhUKCQgLAgQWAgMBAh4HAheAAAoJELsnHWG50ZiEM+MBAMMdppJHzPNRdgke
+bv7+z591+LrQqsKJUBUHjlujsxrbAQCF9RRf2CSTaF2SBD9vrGxdL58Bb/AVs1t6
+ZX/Xf/ozDLg4BGVbItkSCisGAQQBl1UBBQEBB0DtyQW5YnpS1MQ+umPKax706r+R
+RJZRO63fma5e+rhaKgMBCAeIfgQYFgoAJhYhBARIHz68FJQ7lF5Ox7snHWG50ZiE
+BQJlWyLZAhsMBQkSzAMAAAoJELsnHWG50ZiE9w8BAKj36yLaf7do05ObiTjpFR5P
+iDa6aRHJSWDpdut8Q19jAQCfH1WZ2M/2VK0E03k6zcfc56m+z1gwdkq78dAunte2
+BA==
+=GDpl
+-----END PGP PUBLIC KEY BLOCK-----

SECURITY.md

@@ -0,0 +1,49 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are provided for the current stable version of this PHP API client only.
+Any older version is not supported and needs to be updated first before reporting security issues.
+
+## Reporting a Vulnerability
+
+If you've found a security vulnerability in Zammad,
+please report the vulnerability exclusively via email
+to [security@zammad.com](mailto:security@zammad.com).
+
+Please do not combine several independent vulnerabilities,
+but send a separate mail for each of them instead.
+
+To send us a secure message, please use [our public key](SECURITY.asc).
+
+We will get back to you as soon as possible and inform
+you about the next steps. Accepted vulnerabilities will
+be disclosed via patch level release with accompanying
+security advisory.
+
+### Reporting Process Overview
+
+- Potential security issues can be reported via [security@zammad.com](mailto:security@zammad.com).
+- We evaluate them and provide timely feedback to the reporter.
+- There may be security releases created if needed, e.g. [Zammad 6.3.1](https://zammad.com/en/releases/6-3-1).
+- We publish security advisories for every acknowledged issue via [GitHub Security Advisories](https://github.com/zammad/zammad/security/advisories).
+- After their publication, we request CVE identifiers to be assigned to the advisories.
+
+### Rewards
+
+Every first reporter of a vulnerability may be credited
+in the related security advisory.
+
+Zammad does not offer financial compensation through a
+security bounty program.
+
+## Security Measures in Development Workflow
+
+### Dependency Management
+
+Dependencies are managed via [Composer](https://getcomposer.org/).
+You can check for known security vulnerabilities in dependencies by running:
+
+```bash
+composer audit
+```

examples/tag_admin.php

@@ -0,0 +1,68 @@
+<?php
+
+/**
+ * Example for Tag administration scope.
+ *
+ * Manage tags globally: list, create, rename and delete tags.
+ * See https://docs.zammad.org/en/latest/api/ticket/tags.html#administration-scope
+ */
+
+use ZammadAPIClient\Client;
+use ZammadAPIClient\ResourceType;
+
+require __DIR__ . '/../vendor/autoload.php';
+
+$client = new Client([
+    'url'      => 'https://my.zammad.com',
+    'username' => 'my-username',
+    'password' => 'my-password',
+]);
+
+// List all tags (administration scope)
+$tags = $client->resource(ResourceType::TAG)->all();
+echo "All tags:\n";
+foreach ($tags as $tag) {
+    echo sprintf(
+        "  ID: %s, Name: %s, Count: %s\n",
+        $tag->getID(),
+        $tag->getValue('name'),
+        $tag->getValue('count')
+    );
+}
+
+// Create a new tag
+$tag = $client->resource(ResourceType::TAG);
+$tag->setValue('name', 'example-tag');
+$tag->save();
+
+echo "\nTag 'example-tag' created.\n";
+
+// Find the created tag to get its ID
+$tag_id = null;
+$tags = $client->resource(ResourceType::TAG)->all();
+foreach ($tags as $t) {
+    if ($t->getValue('name') === 'example-tag') {
+        $tag_id = $t->getID();
+        break;
+    }
+}
+
+if ($tag_id) {
+    echo "Tag ID: $tag_id\n";
+
+    // Rename the tag (update)
+    // Set the tag's ID so save() will call update() instead of create()
+    $tag = $client->resource(ResourceType::TAG);
+    $tag->setRemoteData(['id' => $tag_id]);
+    $tag->setValue('name', 'example-tag-renamed');
+    $tag->save();
+
+    echo "Tag renamed to 'example-tag-renamed'.\n";
+
+    // Delete the tag
+    $tag = $client->resource(ResourceType::TAG);
+    $tag->setRemoteData(['id' => $tag_id]);
+    $tag->delete();
+
+    echo "Tag deleted.\n";
+}